How to Scan a Suspicious File Before Opening It

 

Downloading files is part of everyday computer use.

We download software installers, PDF documents, ZIP archives, images, spreadsheets, email attachments, and many other types of files.

Most legitimate downloads are harmless, but an unfamiliar file can sometimes contain malware or unwanted software.

The safest approach is not to open a suspicious file immediately.

Instead, pause and investigate it first.

This beginner-friendly guide explains how to check a suspicious file before opening it, how to scan it with Windows Security, when an additional malware scanner may help, and what you should know before uploading a file to an online scanning service.

1. Do Not Open the File Yet

If you are uncertain about a downloaded file, leave it unopened while you investigate.

This is particularly important for unfamiliar:

• .exe files

• .msi installers

• Scripts

• ZIP or other compressed archives

• Unexpected email attachments

• Documents asking you to enable unusual features

• Files downloaded from unfamiliar websites

Opening or running a malicious file may allow it to perform actions on your computer.

Scanning before opening is therefore safer than opening the file simply to see what happens.

2. Ask Where the File Came From

Before using any security scanner, consider the source.

Ask yourself:

• Did I intentionally download this file?

• Did I expect to receive it?

• Did it come from an official website?

• Was it attached to an unexpected email?

• Did someone send it through social media?

• Did a pop-up tell me to download it?

• Did the website ask me to disable antivirus first?

A file from an unknown source deserves more caution than a file intentionally downloaded from a trusted official source.

However, even a familiar-looking sender or website name is not absolute proof that a file is safe.

Accounts and websites can sometimes be compromised or impersonated.

3. Check the File Name Carefully

Look at the filename before opening it.

Attackers may use filenames designed to look harmless or urgent.

For example, a file might appear to be:

Invoice

Photo

Account Statement

Security Update

Delivery Notice

The name itself tells you very little about what the file actually does.

Be especially careful when a file claims to be a document but is actually an executable program.

4. Make File Extensions Visible

Windows can hide extensions for known file types depending on your settings.

This can make a dangerous filename easier to disguise.

For example, something that appears to be:

invoice.pdf

could potentially have a different executable extension if extensions are hidden.

In File Explorer, configure Windows to show file extensions so you can see the complete filename.

Knowing the actual extension does not prove that a file is safe, but it gives you useful information before opening it.

5. Be Careful With Double Extensions

A suspicious filename may use more than one extension.

For example:

invoice.pdf.exe

photo.jpg.scr

document.docx.exe

The first extension may be included simply to make the file look familiar.

The final extension is particularly important because it may indicate the actual file type Windows will execute.

Do not assume a file is a PDF or image simply because those letters appear somewhere in its name.

6. Scan the File With Microsoft Defender

Windows Security can scan individual files and folders.

Locate the suspicious file in File Explorer.

On supported Windows versions, you can right-click the file and use the Microsoft Defender scanning option. Depending on your Windows version, you may first need to choose Show more options.

Then select:

Scan with Microsoft Defender

Windows Security will scan the selected item and report the result.

This is a useful first check before opening an unfamiliar file.

7. What If Microsoft Defender Detects a Threat?

Do not immediately override the warning.

Read the detection information carefully.

Windows Security may:

• Block the file

• Quarantine it

• Recommend removal

• Request an action

• Identify it as potentially unwanted software

If you do not understand the detection, leaving the item blocked or quarantined while you investigate is generally safer than immediately choosing to allow it.

Do not select Allow on device simply because you want the program to run.

8. What If the Scan Says No Threats Were Found?

A clean scan is reassuring, but it is not an absolute guarantee.

Security products rely on multiple detection techniques, and new or unusual malicious files may not always be recognized immediately.

Therefore, consider the scan result together with:

• Where the file came from

• Whether you expected it

• Its filename and extension

• The reputation of the website

• Whether the publisher is known

• Whether other security tools raise concerns

Think of an antivirus scan as one piece of evidence rather than a perfect safety certificate.

9. Check the File's Digital Signature When Appropriate

Some legitimate software installers are digitally signed by their publishers.

For certain executable files, you can inspect:

Right-click → Properties → Digital Signatures

If a Digital Signatures tab is available, review the listed signer.

A valid signature can provide useful information about who signed the file and whether the signed content appears intact.

However, a signature does not automatically mean the software is trustworthy.

Malicious or unwanted software can sometimes also be signed.

Treat publisher information as another piece of evidence.

10. Check the Publisher Before Installing Software

When installing software, Windows may display information about the publisher.

Ask:

• Is the publisher name what I expected?

• Does it match the company whose software I intended to download?

• Is Windows showing an unknown publisher?

• Did I download the installer from the official website?

An unknown publisher does not automatically mean malware.

But it is a reason to investigate further, particularly if the file came from an unfamiliar source.

11. Use an Additional Trusted Malware Scanner When Needed

Sometimes you may want a second opinion.

A reputable on-demand malware scanner can provide an additional check.

For example, Malwarebytes supports scanning specific files, folders, and drives.

An additional scanner can be useful when:

• You remain uncertain after the first scan

• The file came from a questionable source

• Your computer recently showed suspicious behavior

• Another security warning appeared

• You want an additional opinion before opening a file

However, do not install many random security programs simply to scan one file.

Use established security tools from their official sources.

12. Scan a File With Malwarebytes

If Malwarebytes is installed, Windows users can locate the file in File Explorer and use the file's context menu to scan it with Malwarebytes.

Depending on your Windows version and Malwarebytes configuration, the option may appear directly or under additional context-menu options.

After the scan, review the result rather than assuming that no detection means absolute safety.

A second scanner is additional evidence, not a guarantee.

13. Consider VirusTotal for an Additional Reputation Check

VirusTotal is an online service that can analyze files using information from many security vendors and analysis tools.

It can be useful when you want additional information about an unfamiliar file.

Instead of relying on the verdict of only one security product, you can see how multiple detection systems and analysis sources respond.

This can help identify files that deserve further investigation.

However, VirusTotal should not replace the antivirus protection installed on your computer.

14. Understand VirusTotal Results Correctly

VirusTotal results require interpretation.

Suppose many security engines report no detection while one or two engines flag a file.

That does not automatically prove either that:

• The file is malicious, or

• The file is safe.

False positives can occur.

New malware can also sometimes avoid detection.

Consider:

• How many engines detect the file

• What detection names they use

• Whether well-known security vendors agree

• File reputation and metadata

• Where you obtained the file

• Whether the file behaves as expected

Do not reduce a complicated security decision to a single number.

15. Think About Privacy Before Uploading a File

This is extremely important.

Uploading a file to an online malware-analysis service means you are sending that file to another service for analysis.

Standard VirusTotal submissions contribute to its broader security-analysis ecosystem and information from submissions can be shared with examining partners.

Therefore, do not casually upload:

• Personal documents

• Private photographs

• Tax documents

• Medical records

• Confidential business files

• Client information

• Password databases

• Private contracts

• Proprietary source code

• Any other sensitive information

If privacy matters, understand the service's submission and privacy policies before uploading anything.

16. Public and Private VirusTotal Scanning Are Not the Same

VirusTotal also provides a separate Private Scanning offering for eligible customers.

Private Scanning is designed so submitted files and URLs are not shared outside the user's organization and are retained only for a limited period.

However, this is a separate offering with specific access requirements and should not be confused with ordinary public VirusTotal submissions.

For an everyday user, the safest rule is simple:

Do not upload confidential files to a public analysis service just because you want an antivirus opinion.

17. Consider Checking a File Hash

A cryptographic file hash acts like a digital fingerprint for a file.

Common examples include:

• SHA-256

• SHA-1

• MD5

For security checking, SHA-256 is commonly used to identify a specific file.

If a file has already been analyzed by a security service, searching for its hash may allow you to review existing information without uploading the actual file again.

This can be particularly useful when privacy prevents you from submitting the file itself.

However, a hash lookup only helps if information about that exact file already exists.

18. Compare Official File Hashes When Available

Some software publishers provide official checksums or hashes for downloads.

If the publisher provides an official SHA-256 value, you can calculate the hash of your downloaded file and compare the two.

If they match exactly, this provides evidence that the downloaded file matches the publisher's referenced file.

But remember:

A matching hash confirms file identity relative to the published hash.

It does not independently prove that the publisher's software itself is safe.

19. Be Extra Careful With Email Attachments

Unexpected attachments deserve special caution.

Attackers may disguise malicious files as:

• Invoices

• Resumes

• Shipping notices

• Bank documents

• Tax documents

• Photos

• Account alerts

• Payment receipts

Before opening an attachment, ask whether you expected it.

If the message claims to come from a company, consider checking your account through the company's official website or app instead of trusting the attachment.

If it claims to come from someone you know but seems unusual, verify with that person through another communication method.

20. Be Careful With Password-Protected Archives

A suspicious message may provide a ZIP or other archive along with a password.

Password protection is not evidence that a file is legitimate.

Attackers may use protected archives as part of malware-delivery campaigns.

If you did not expect the archive, verify its source before extracting or opening its contents.

Do not assume an attachment is trustworthy simply because the sender provided a password.

21. Do Not Disable Antivirus to Open a File

A major warning sign is an instruction such as:

“Turn off your antivirus before opening this file.”

There can be legitimate software compatibility situations, but beginners should treat this instruction cautiously.

Do not disable Microsoft Defender, SmartScreen, your firewall, or another trusted security tool merely because an unfamiliar download tells you to.

If legitimate software is being incorrectly detected, verify the software through official support channels before overriding security protection.

22. Pay Attention to Microsoft Defender SmartScreen

Microsoft Defender SmartScreen and related reputation-based protections can warn about suspicious or unrecognized downloads and websites in supported Microsoft environments.

If Windows or your browser displays a security warning, do not automatically bypass it.

Investigate:

• Where the file came from

• Who published it

• Why it was flagged

• Whether you actually need the file

Security warnings exist to give you a chance to reconsider before running potentially unsafe content.

23. Do Not Trust a File Because Someone Says “My Antivirus Says It Is Safe”

Security results can differ between:

• Antivirus products

• Detection versions

• Security intelligence updates

• Scan settings

• Analysis environments

A screenshot of somebody else's clean scan is not strong proof that the file you downloaded is identical or safe.

Scan your own copy and verify its source.

24. Do Not Test Suspicious Files by Opening Them

Beginners should never use their everyday computer as a malware-testing environment.

Do not open a suspicious executable simply to see what it does.

Professional malware researchers use isolated analysis environments, virtual machines, sandboxes, and other controls.

Opening unknown software on the same computer that contains your passwords, personal documents, photos, and accounts creates unnecessary risk.

25. What Should You Do If Multiple Scanners Detect the File?

If multiple reputable security engines identify a file as malicious, treat that as a serious warning.

Do not run it merely because:

• You need the program

• A forum user says it is safe

• The download website says detections are false positives

• The installer tells you to disable antivirus

Delete or quarantine the file unless you have strong, independently verified reasons to believe the detections are incorrect.

When in doubt, obtain the software from its official source instead.

26. What If Only One Scanner Detects It?

A single detection requires interpretation.

It could represent:

• A false positive

• A potentially unwanted application

• A heuristic detection

• A newly detected threat

• A genuinely malicious file

Do not immediately ignore it.

Research:

• The detection name

• The security vendor reporting it

• The file publisher

• The download source

• Other scan results

If you do not need the file, the simplest safe choice may be not to run it.

27. What If You Already Opened the Suspicious File?

If you already ran the file and now have concerns:

1. Stop running the program.

2. Open Windows Security.

3. Run an appropriate malware scan.

4. Review Protection History.

5. Consider a Full scan if warranted.

6. Review recently installed applications.

7. Check browser extensions if the file affected your browser.

8. Watch for unusual account activity.

9. Consider an additional trusted malware scanner.

10. Seek qualified technical assistance if suspicious behavior continues.

If important passwords may have been exposed, change them from a trusted device.

28. Signs the File May Have Caused a Problem

After opening an unfamiliar file, pay attention to unexpected:

• Antivirus alerts

• Browser redirects

• Pop-ups

• New applications

• New browser extensions

• Disabled security features

• High CPU or network usage

• Files becoming inaccessible

• Unknown account sign-ins

• Programs starting automatically

One symptom alone does not prove malware.

But several unexplained changes after running a suspicious file deserve investigation.

29. A Simple Suspicious File Checklist

Before opening an unfamiliar file, ask:

• Did I intentionally download it?

• Is the source trustworthy?

• Is the full file extension visible?

• Does the filename make sense?

• Did Microsoft Defender scan it?

• Did the scan report any threat?

• Is the publisher what I expected?

• Does the file have a relevant digital signature?

• Do I need a second malware-scanner opinion?

• Can I check reputation without uploading private information?

• Am I being asked to disable security?

• Do I actually need to open this file?

If several answers make you uncomfortable, do not open the file.

30. The Safest Rule for Beginners

You do not have to prove that every suspicious file is malicious.

Sometimes the safest decision is simply not to open it.

If you can obtain the same software or document from a trusted official source, do that instead.

If the file is unnecessary, deleting it removes the need to take the risk.

Security is often about avoiding unnecessary exposure rather than investigating every questionable download.

Final Verdict

Scanning a suspicious file before opening it is a good security habit, but scanning should be only one part of your decision.

Start by checking where the file came from, its full filename and extension, and whether you expected to receive it.

Then scan it with Microsoft Defender or your active trusted antivirus.

When necessary, use a reputable second-opinion scanner such as Malwarebytes.

VirusTotal can provide additional reputation and multi-source analysis information, but remember that uploading files to an online service can have privacy implications.

Most importantly, do not treat a clean scan as a guarantee.

Consider the source, publisher, digital signature, reputation, security warnings, and whether you actually need the file.

If a file looks suspicious and you do not have a strong reason to trust or use it, the safest choice is often simple:

Do not open it.

Guide note: This article reflects Windows, Malwarebytes, and VirusTotal guidance available in August 2026. Security interfaces, scanning options, and service policies can change. Check the current official documentation when the options on your device differ.