How to Scan Downloads for Malware

The safest scan is the one you never need because you downloaded from the right place. Always get software from the official vendor's website or a reputable app store. Be especially wary of search ads, which sometimes lead to lookalike sites, and of "download portals" that wrap installers in their own adware-laden downloader.

Steer clear of cracked, pirated or "pro unlocked" software entirely. These are among the most common malware carriers, and no antivirus catches everything. If the official version is free, there is no reason to risk a tampered copy.

Once a file is downloaded, scan it before opening. On Windows, the built-in Microsoft Defender is solid: right-click the file and choose Scan, or let real-time protection check it automatically. On macOS, built-in protections like Gatekeeper and XProtect screen downloads, and you can add a reputable third-party scanner if you want extra coverage.

Keep your antivirus and its definitions up to date; an out-of-date scanner misses recent threats. A single, well-maintained antivirus is better than stacking several, which can conflict.

For anything you are unsure about, upload the file to VirusTotal, a free service that scans it with dozens of antivirus engines at once and reports which, if any, flag it. Because it pools many engines, it catches threats a single antivirus might miss. You can also paste a download URL or a file's hash to check it without uploading.

One caveat: do not upload confidential files, since submissions can be shared with security vendors. For sensitive documents, scan the file's hash instead of the file itself, or rely on local scanning. A handful of flags from obscure engines can be false positives, but several reputable engines agreeing is a strong warning.

When a publisher lists a checksum (ideally SHA-256), verify it. Calculate the hash of your downloaded file and compare it to the official value; a match confirms the file was not corrupted or tampered with in transit. On Windows use PowerShell's Get-FileHash, on macOS use shasum -a 256, and on Linux use sha256sum. A mismatch means delete and re-download from the official source.

Where projects offer signed releases, verifying the digital signature is even stronger, because it proves the publisher's identity, not just the file's integrity.

Attackers rely on a small set of reliable tricks. Learn to recognize them:

• Fake download buttons: big, colorful "Download" ads that are not the real link. Find the genuine, often smaller, official link.
• Double extensions: a file named invoice.pdf.exe is an executable, not a PDF. Enable file extension display so you can see the real type.
• Unexpected file types: a document download that arrives as an .exe, .scr or script file is a red flag.
• Password-protected archives: sometimes used to hide malware from scanners; treat with suspicion.

When in doubt, do not open it. Delete the file and start over from a source you trust.