How to Check if a Downloaded File Contains Malware

Downloading a file doesn’t necessarily mean your computer is infected. However, a downloaded file can contain malware, especially when it comes from an unknown website, an untrusted source, a suspicious email, or an unfamiliar file-sharing platform.

Malicious files can include viruses, trojans, ransomware, spyware, keyloggers, information stealers, and other unwanted software. Some are obvious, while others are designed to operate quietly in the background.

The good news is that you can perform several checks before opening or executing a downloaded file.

In this guide, we’ll explain how to check if a downloaded file contains malware, how to scan files safely, what warning signs to look for, how to check suspicious file extensions, and what to do if you think you’ve already opened a malicious file.

Important: No single malware scan can guarantee that a file is completely safe. The safest approach is to combine trusted security software, file-source verification, careful inspection, and good security practices.

What Does It Mean When a File Contains Malware?

Malware is short for malicious software. It refers to software designed to perform unwanted or harmful actions.

A malicious downloaded file might:

• Steal passwords
• Capture sensitive information
• Encrypt files
• Monitor activity
• Install additional malware
• Modify system settings
• Display unwanted advertisements
• Provide unauthorized remote access
• Use your computer’s resources
• Attempt to spread to other systems

The file itself may look completely normal.

For example, a file named:

Important_Document.pdf

might not actually be a PDF.

It could potentially be:

Important_Document.pdf.exe

depending on how your operating system displays file extensions.

That’s why checking a downloaded file before opening it is important.

Can You Tell If a File Contains Malware Without Opening It?

Often, yes.

You can perform several checks without executing the file.

These include:

1. Checking the file extension
2. Scanning the file with security software
3. Checking the file’s properties
4. Verifying its source
5. Comparing its checksum with an official value
6. Looking for suspicious filenames
7. Checking whether the file type matches what you expected
8. Reviewing unexpected instructions associated with the download
9. Using a reputable multi-engine scanning service where appropriate
10. Inspecting suspicious archives carefully

These checks don’t provide an absolute guarantee, but they can help identify many suspicious files before they are opened.

1. Don’t Open the File Yet

The first and most important step is simple:

Don’t open a suspicious downloaded file just to see what it does.

If you’re unsure about a file, don’t:

• Double-click it
• Run it as administrator
• Open it with an unknown program
• Enable macros
• Allow scripts
• Disable your antivirus
• Add it to a security exclusion

Instead, investigate it first.

This is particularly important for files downloaded from unfamiliar websites or unknown users.

2. Check the File Extension

One of the easiest checks is to inspect the actual file extension.

Common executable or script-related extensions include:

• .exe
• .msi
• .scr
• .bat
• .cmd
• .ps1
• .vbs
• .js
• .jar

These extensions aren’t automatically malicious.

For example, a legitimate Windows application may naturally use .exe.

The important question is:

Does this file type make sense for what you downloaded?

If you downloaded a photograph and received:

holiday_photo.jpg.exe

that’s very different from receiving:

holiday_photo.jpg.

Be Careful With Double Extensions

A file may be deliberately named to look harmless.

Examples:

invoice.pdf.exe

photo.jpg.scr

document.docm

video.mp4.exe

The last extension is particularly important.

Don’t judge a file solely by the first extension you see.

3. Make Sure File Extensions Are Visible

Operating systems can sometimes hide known file extensions.

That can make a malicious file easier to disguise.

For example, if .exe is hidden, a file might appear visually similar to:

Invoice.pdf

while its actual name is:

Invoice.pdf.exe

Enabling visible file extensions makes it easier to inspect downloaded files.

Why This Matters

File names are only useful when you can see what type of file you’re actually dealing with.

Make it a habit to inspect:

Full filename + actual extension

before opening unfamiliar downloads.

4. Scan the File With Your Security Software

Your installed security software should be one of the first places to check.

Modern operating systems commonly include built-in malware protection, while many users also use reputable third-party security products.

Right-click the downloaded file and look for an option similar to:

Scan with security software

The exact wording depends on your operating system and security product.

What Does a Malware Scan Do?

A security scanner may examine the file for:

• Known malware signatures
• Suspicious behavior patterns
• Malicious code
• Potentially unwanted software
• Other indicators of compromise

If the scanner reports malware, don’t ignore the warning just because the file came from a familiar-looking website.

5. Keep Your Antivirus Updated

A malware scanner is only as useful as its current detection capabilities.

Make sure your security software is:

• Enabled
• Updated
• Receiving current threat intelligence
• Not intentionally excluded from scanning the downloaded file

New malware appears constantly, so an outdated security database may not recognize newer threats.

Don’t Disable Security Software to Run a Download

If a download tells you:

“Disable antivirus before installing.”

stop and investigate.

There may occasionally be legitimate false positives, but blindly disabling protection for an unknown file is a poor security practice.

6. Check the Source of the File

Where you obtained the file matters.

A file downloaded directly from an official software publisher is generally easier to verify than an unknown executable from a random website.

Before opening a file, ask:

Who published this file?

For legitimate software, look for:

• Official website
• Official project page
• Official release page
• Developer documentation
• Known distribution channel

The more trustworthy the original source, the easier it is to verify the file’s authenticity.

7. Compare the File With the Official Version

If the publisher provides an official download, compare your downloaded file against it.

Useful information can include:

• File name
• Version
• File size
• Release date
• SHA-256 checksum
• Digital signature

For example, if the official publisher says:

Application-4.2.1.exe

but your download is:

Application-Pro-Ultimate-Crack.exe

you should not assume they are the same file.

A similar filename does not prove authenticity.

8. Check the File Hash

A cryptographic hash creates a unique-looking string based on a file’s contents.

Common algorithms include:

• SHA-256
• SHA-512

Suppose an official publisher provides:

SHA-256: [official hash value]

You can calculate the SHA-256 hash of your downloaded file and compare the result.

What Does a Matching Hash Mean?

If the hash matches an independently trusted value published by the legitimate software provider, it provides strong evidence that the file hasn’t been altered since that reference was generated.

If the hash doesn’t match:

Do not assume the file is safe.

It may be a different version, a modified file, or simply a different build.

Where Should the Expected Hash Come From?

Ideally, obtain it from:

• The official publisher
• The official project
• A trusted release page

Don’t rely on a checksum published only by the same unknown website that provided the suspicious file.

9. Check the Digital Signature

Some legitimate software is digitally signed by its publisher.

A valid digital signature can help establish:

• Who signed the software
• Whether the signature is valid
• Whether the file has been modified since signing

On supported operating systems, you can usually inspect a file’s properties and look for a Digital Signatures section when one is present.

What Does a Digital Signature Tell You?

A valid signature from the expected publisher is useful evidence of authenticity.

However, don’t confuse:

Digitally signed

with:

Automatically safe

A valid signature is strongest when the signer is the organization you expect and the file comes from a trustworthy source.

10. Upload the File to a Multi-Engine Scanner

For suspicious files, a reputable online malware-analysis service can provide another layer of information by checking a file against multiple security engines.

One well-known example is VirusTotal.

How Multi-Engine Scanning Helps

Instead of relying on a single antivirus engine, multi-engine scanning can provide results from numerous security vendors.

You might see results such as:

• 0 detections
• 1 detection
• Several detections
• Many detections

Does 0 Detections Mean the File Is Safe?

No.

A result showing no detections does not guarantee that a file is harmless.

Reasons include:

• New malware may not yet be detected.
• Some threats are highly targeted.
• Some malicious behavior only appears when executed.
• Detection engines can disagree.

Also consider privacy before uploading files. Don’t upload confidential documents, private photos, credentials, proprietary business files, or other sensitive material to public scanning services unless you understand the service’s handling and sharing implications.

11. Check the File Size

File size can provide another useful clue.

Suppose you’re downloading a software installer that the publisher says is approximately 500 MB.

You instead receive a file that’s only 2 MB.

That doesn’t automatically mean malware, but it deserves investigation.

Likewise, an unusually large file may be worth checking if its size doesn’t match the official release.

Use File Size as a Clue

File size is not proof.

A malicious file can be intentionally padded to appear larger.

Use it alongside:

• Hash verification
• Source verification
• Version checking
• Security scanning

12. Look at the File’s Properties

Before opening an unfamiliar file, inspect its properties.

Depending on your operating system, you may be able to see:

• File type
• File size
• Creation information
• Modification information
• Publisher
• Digital signature
• Security information

These details can sometimes reveal inconsistencies.

For example, a file claiming to be official software but showing an unexpected publisher may deserve further investigation.

13. Be Careful With Office Documents

Microsoft Office documents can contain active content.

Examples include documents with:

• Macros
• Embedded objects
• Scripts
• External connections

Be particularly cautious when an unfamiliar document asks you to:

Enable Content

or

Enable Macros

just to view ordinary information.

Don’t Enable Macros Automatically

If someone sends you an unexpected document and says:

“Enable macros to view this invoice.”

don’t do it automatically.

First verify:

• Who sent the document
• Why you received it
• Whether the document was expected
• Whether the sender’s identity is genuine

14. Treat Archives With Extra Caution

Archives such as:

• .zip
• .rar
• .7z

can contain multiple files.

An archive isn’t automatically dangerous.

However, the archive may contain an executable or script that is more dangerous than the archive itself.

For example:

Documents.zip

could contain:

Invoice.pdf

or it could contain:

Invoice.pdf.exe

Scan Extracted Files Too

If your security software scans the archive, that is useful.

But after extracting it, inspect and scan the individual files as well.

Don’t assume that a safe-looking archive name means every file inside is safe.

15. Watch for Suspicious Instructions

Malicious downloads often come with instructions designed to persuade users to bypass security controls.

Be cautious if you’re told to:

• Disable antivirus
• Disable firewall
• Run as administrator
• Add a folder to antivirus exclusions
• Run PowerShell commands
• Run Command Prompt commands
• Install an unknown codec
• Install an unknown browser extension
• Turn off security warnings

These instructions don’t automatically prove malware, but they significantly increase the need for verification.

16. Be Suspicious of Cracked or Modified Software

Unofficially modified software is a particularly important security risk.

Examples include:

• Cracks
• Keygens
• Activators
• “Premium unlocked” versions
• Modified installers
• Pirated software packages

These files may be altered in ways that are difficult to verify.

Some may also trigger antivirus warnings because they contain suspicious behavior.

Why Modified Software Is Risky

When software has been modified, you can’t necessarily rely on the original developer’s security assurances.

A safer approach is to obtain software directly from the legitimate publisher whenever possible.

17. Check for Unexpected Network Activity

If you’ve already opened a suspicious file, pay attention to unusual behavior.

Potential warning signs include:

• Unexpected network connections
• Unknown applications communicating online
• Sudden bandwidth usage
• Repeated connections to unfamiliar destinations

Network activity alone doesn’t prove malware.

Many legitimate applications communicate with servers.

However, unexpected network behavior combined with other warning signs deserves investigation.

18. Watch for System Changes

After opening a suspicious file, watch for unusual system behavior.

Possible warning signs include:

• New applications appearing
• Browser homepage changes
• Unknown browser extensions
• Unexpected pop-ups
• New startup programs
• Security software being disabled
• Files being renamed or encrypted
• Unusual CPU or disk usage
• Unexpected account activity

One symptom alone doesn’t prove infection.

But several unexplained changes appearing immediately after opening a suspicious file should be taken seriously.

19. Check for Unexpected File Changes

Malware can sometimes modify files.

After opening a suspicious download, be alert for:

• Files suddenly becoming inaccessible
• Documents changing names
• New extensions appearing
• Large numbers of files being modified
• Files becoming encrypted
• Unknown files appearing

If many files suddenly become inaccessible or encrypted, stop interacting with the affected system and investigate immediately.

Do not keep experimenting with suspicious programs.

20. Don’t Trust the File Name

Malware authors can name files anything they want.

A malicious program could be named:

Important_Update.exe

Security_Fix.exe

Invoice.exe

Chrome_Update.exe

or

Windows_Update.exe

A convincing name doesn’t make the file legitimate.

The source, publisher, signature, hash, and behavior matter much more than the filename.

21. Don’t Trust the File Icon

Icons can also be misleading.

An executable can potentially use an icon that looks like:

• A PDF
• A video
• A document
• A folder
• A familiar application

Therefore:

File icon ≠ file type

Always inspect the actual extension and scan unfamiliar files.

22. Check Whether the File Was Expected

Context matters.

Ask:

Was I actually expecting this file?

For example, if someone sends you an invoice you never requested, that’s a reason for caution.

Likewise, if a website suddenly downloads an executable when you expected a PDF, don’t open it just because the download was triggered by a button you clicked.

Unexpected downloads deserve additional scrutiny.

23. Use a Safe Environment for High-Risk Files

If you are a security professional or technically experienced user who needs to analyze a suspicious file, consider using an isolated analysis environment such as a properly configured virtual machine or sandbox.

The goal is to prevent potentially malicious software from interacting with your primary system.

However, virtualization is not a magic security guarantee.

Poorly configured environments can still have risks.

For ordinary users, the safer option is often simply:

Don’t execute a file you cannot verify.

24. Don’t Run Suspicious Files as Administrator

Administrative privileges can give software significantly greater access to a system.

If an unfamiliar file asks for administrator permission, don’t automatically approve it.

Instead, verify:

• Publisher
• Source
• Digital signature
• Expected purpose

A legitimate installer may need elevated privileges, but an unknown program asking for administrator access is a reason to stop and investigate.

25. Use Multiple Checks Instead of One

The strongest approach is to combine several signals.

For example:

• Trusted official source
• Expected filename
• Correct version
• Matching SHA-256
• Valid publisher signature
• Clean security scan

provides considerably more confidence than simply seeing:

“No antivirus detected anything.”

Think of malware checking as a layered process.

Quick Malware Checking Checklist

Before opening an unfamiliar downloaded file, ask:

• Did I expect this file?
• Where did it come from?
• Do I trust the source?
• Is the file extension correct?
• Does the file type match what I expected?
• Does the file size make sense?
• Does the version match the official release?
• Does the publisher match the expected publisher?
• Is there a valid digital signature?
• Does the SHA-256 hash match the official value?
• Has reputable security software scanned it?
• Does anything about the file seem unusual?
• Does it ask me to disable security software?

If several answers concern you, don’t open the file.

What to Do If Your Antivirus Detects Malware

If your security software identifies a downloaded file as malicious, take the warning seriously.

Generally:

1. Don’t open the file again.
2. Allow the security software to quarantine or remove it when appropriate.
3. Don’t add the file to an exclusion just to make it run.
4. Run another scan if you suspect additional threats.
5. Investigate where the file came from.
6. Delete suspicious copies if they are no longer needed.
7. If the file was executed, investigate the system for signs of compromise.

If the file came from an account, website, or source you control, consider changing relevant credentials from a known-clean device if you suspect those credentials may have been exposed.

What If You Already Opened the Suspicious File?

The response depends on what happened.

If you opened a document and nothing unusual happened, that doesn’t necessarily mean the file was safe.

If you executed a suspicious program, take the situation more seriously.

If You Suspect an Infection

Consider:

• Disconnecting the affected device from the network when appropriate.
• Running a full scan using reputable security software.
• Checking for unfamiliar applications.
• Reviewing startup programs.
• Checking browser extensions.
• Looking for unusual account activity.
• Changing important passwords from a known-clean device if credential theft is suspected.
• Enabling multi-factor authentication.
• Restoring from a known-good backup when appropriate.
• Seeking professional assistance for serious infections.

If ransomware or widespread file encryption is suspected, avoid repeatedly interacting with the affected system and prioritize containment and recovery.

How to Tell the Difference Between a False Positive and Malware

Security software can occasionally flag legitimate files.

This is called a false positive.

A detection doesn’t automatically prove that a file is malicious.

However, don’t dismiss a detection simply because:

“My friend says it’s safe.”

Instead, investigate:

• Who published the file?
• Is it from the official source?
• Is the digital signature valid?
• Does the hash match?
• Are multiple security engines detecting it?
• Does the developer acknowledge the detection?
• Is the file behaving unexpectedly?

The more independent evidence you have, the easier it becomes to distinguish a false positive from a genuine threat.

Downloaded File Safety: A Simple Decision Process

Use this process whenever you’re unsure about a file.

Stage 1: Before Opening

Check:

Source → Filename → Extension → File size → Publisher

If something looks wrong, stop.

Stage 2: Verify

Check:

Official version → Digital signature → SHA-256 → Security scan

If the evidence doesn’t match, don’t run it.

Stage 3: Investigate

If security software reports a threat:

Quarantine → Investigate → Scan → Remove or recover

Don’t bypass the warning without understanding why it appeared.

Common Downloaded File Warning Signs

Common Mistakes When Checking Downloaded Files

Mistake 1: Opening the File First

Don’t execute a suspicious file and investigate afterward.

Check first, open second.

Mistake 2: Trusting the Filename

A convincing filename doesn’t establish authenticity.

Mistake 3: Trusting the Website Alone

A professional-looking website can still distribute malicious files.

Mistake 4: Assuming 0 Antivirus Detections Means Safe

No detection means no detection at that moment.

It does not mean guaranteed safety.

Mistake 5: Disabling Antivirus

Never disable security software simply because a downloaded file tells you to.

Mistake 6: Ignoring Digital Signatures

For signed software, checking the publisher can provide useful authenticity information.

Mistake 7: Ignoring Hash Mismatches

If an official SHA-256 value doesn’t match your file, investigate before running it.

Mistake 8: Uploading Sensitive Files to Public Scanners

Multi-engine scanning can be useful, but don’t upload confidential documents or private data without understanding the privacy implications.

Frequently Asked Questions

How can I check if a downloaded file has a virus?

Start by not opening the file. Check its extension and source, scan it with reputable security software, and compare its hash or digital signature with trusted official information when available.

Is a downloaded file safe if antivirus says it’s clean?

Not necessarily. A clean scan reduces concern but doesn’t provide a 100% guarantee.

Can a PDF contain malware?

Yes. PDFs can contain active or malicious content in some circumstances. Be cautious with unexpected PDF files and keep your PDF reader updated.

Can a ZIP file contain a virus?

Yes. A ZIP file can contain malicious executables, scripts, or documents. Scan the archive and inspect the extracted files before opening them.

Is an EXE file automatically a virus?

No. .exe is a normal executable format used by legitimate Windows applications. The important factors are source, publisher, signature, behavior, and security scan results.

What does SHA-256 tell me about a downloaded file?

SHA-256 produces a fingerprint of the file’s contents. If your file’s hash matches a trusted official hash, it provides strong evidence that the file is identical to the referenced file.

Is VirusTotal enough to prove a file is safe?

No. Multi-engine scanners are useful, but 0 detections does not guarantee that a file is safe.

Should I upload every suspicious file to an online scanner?

Not necessarily. Avoid uploading confidential, personal, proprietary, or otherwise sensitive files without first understanding the service’s privacy and sharing practices.

What should I do if antivirus quarantines my downloaded file?

Don’t restore or execute it simply because you need the file. Investigate the detection and verify the source, publisher, signature, and hash where possible.

What if I already ran a suspicious file?

Run a full security scan, investigate unusual system behavior, and consider disconnecting the device from the network if you suspect active compromise. If credentials may have been stolen, change important passwords from a known-clean device and enable multi-factor authentication.

Can a file be malicious even if it has a digital signature?

Yes. A signature primarily helps establish who signed the file and whether it has been modified since signing. You should still verify that the signer is the expected publisher and that the file came from a trustworthy source.

Final Thoughts

Knowing how to check if a downloaded file contains malware is an important part of staying safe online.

The best strategy is to avoid relying on a single security check.

Instead, combine several layers:

• Don’t open suspicious files immediately.
• Check the actual file extension.
• Verify where the file came from.
• Compare it with the official version.
• Check the publisher and digital signature.
• Verify SHA-256 when an official checksum is available.
• Scan the file with reputable security software.
• Use multi-engine scanning when appropriate.
• Be cautious with archives, scripts, macros, and executables.
• Never disable security protections just because a download instructs you to.
• Treat cracked or modified software with extra caution.
• Pay attention to unusual behavior after execution.

Most importantly, remember:

If you cannot verify a downloaded file, you don’t have to open it.

A few minutes spent checking a file before execution can prevent much bigger problems later.