How This File Scanner Works

Most "online virus scanner" widgets you'll find on download sites are fake — they show a progress bar and always conclude with "Clean ✓" regardless of the file. That's deceptive content, and Google's spam detection systems demote sites that use it. This scanner is different. Here's exactly what happens when you drop a file into the inspector above:

1. The file stays on your device. Your browser reads it locally using the standard FileReader API. No network request is made during the read or hash computation phase.
2. SHA-256 and MD5 hashes are computed in your browser. Modern browsers expose the Web Crypto API which calculates SHA-256 cryptographic hashes natively — fast, accurate, and entirely client-side. MD5 is computed via a verified pure-JavaScript implementation that matches the RFC 1321 standard.
3. File metadata is extracted. Filename, size, MIME type, extension, and last-modified timestamp all come from the file's headers — read locally without network access.
4. A VirusTotal lookup link is generated. Using your file's SHA-256 hash, we construct a URL like https://www.virustotal.com/gui/file/<hash>. If VirusTotal has previously scanned a file with this exact hash — extremely common for popular software — you'll see real results from 70+ antivirus engines plus sandbox behavioural analysis.
5. If VirusTotal hasn't seen the file, the second button ("Upload to VirusTotal") opens VirusTotal's official upload page where you can submit the file directly to them under their privacy policy.

Why You Should Scan Every Downloaded File

The "I only download from official sites" defence used to work. It doesn't anymore. In the past decade, multiple supply-chain attacks have proven that even reputable software publishers can ship malware to millions of users. The threat landscape has fundamentally shifted from "malicious sites pushing bad software" to "trusted sites compromised at the source". Some notable cases:

• CCleaner (2017) — Avast-owned cleaning utility shipped a backdoored version to 2.27 million users via the official download page. Discovered weeks after the compromise.
• ASUS Live Update (2019) — ASUS's own software updater was compromised, distributing malware to nearly 1 million devices through a digitally-signed legitimate update channel.
• SolarWinds (2020) — Network monitoring software shipped malicious updates to 18,000 organisations including US federal agencies. The breach went undetected for nine months.
• 3CX (2023) — Popular VoIP client was trojanised in a cascading supply-chain attack affecting 600,000+ companies worldwide.
• XZ Utils (2024) — A nearly-successful backdoor was discovered in a core Linux compression library after years of social engineering against the project's maintainer.

The lesson: verifying downloads is good hygiene regardless of source. It takes 30 seconds and catches issues that your installed antivirus might miss. Beyond outright malicious software, there are several common categories of unwanted programs that scanning helps you catch:

• Trojanised installers that bundle adware, browser hijackers, or cryptocurrency miners alongside legitimate software.
• Outdated versions hosted on aggregator sites that contain known security vulnerabilities, even if the original release was clean.
• Modified binaries that have been altered since leaving the publisher — sometimes for legitimate reasons (regional builds, optional patches) and sometimes maliciously.
• Mirror compromise — even legitimate download mirrors have been hijacked. The Transmission BitTorrent client suffered repeated compromises in 2016.
• Potentially Unwanted Programs (PUPs) — toolbars, search hijackers, system "optimisers" that aren't strictly malicious but are unwanted.

5 Free Methods to Scan Downloaded Files

There's no single "best" scanning method — they each have strengths. Here's a comparison of the five most useful approaches, all of which are completely free for personal use:

For most situations, VirusTotal is the gold standard. It runs your file against more antivirus engines than any single product can, plus performs sandbox analysis to observe what the file actually does when run. The other methods are complementary — use them when you want a second opinion, when uploading is undesirable, or when you need behavioural analysis.

Method 1: Scan with VirusTotal (Recommended)

VirusTotal is owned by Google's parent company Alphabet (acquired in 2012) and is the industry-standard service for cross-engine malware analysis. It's free, requires no registration for basic use, and works on every operating system through any web browser.

Option A: Hash Lookup (Privacy-Preserving)

If you don't want to upload your file, you can search VirusTotal by hash. If the file has been seen before — extremely common for popular software, drivers, and major releases — you'll get instant results without uploading anything yourself.

1. Compute the file's SHA-256 hash. Use the inspector at the top of this page (computes locally in your browser), or use the command line: on Windows, certutil -hashfile yourfile.exe SHA256. On macOS or Linux, shasum -a 256 yourfile.dmg.
2. Open virustotal.com and click the "Search" tab at the top.
3. Paste the SHA-256 hash and press Enter.
4. If results appear, you'll see how many antivirus engines flagged the file (e.g., "0 / 71" or "3 / 71"). Zero detections from a popular file with hundreds of community comments equals consensus clean.
5. If "No matches found" appears, VirusTotal hasn't seen your specific file before — proceed to Option B and upload it for fresh analysis.

Option B: Direct File Upload

1. Visit virustotal.com/gui/home/upload.
2. Drag your file onto the upload area, or click "Choose file". The free-tier limit is 650 MB per file.
3. Wait 20–60 seconds while VirusTotal queues your file across 70+ antivirus engines and runs it through their sandbox.
4. Review the detection ratio at the top of the result page (e.g., "5/72").
5. Click the "Details" tab for file metadata and structural analysis, "Behavior" for sandbox observation results (network connections, file modifications, registry changes), and "Community" for analyst comments and reputation history.

Method 2: Microsoft Defender (Built into Windows)

Every Windows 10 and Windows 11 PC comes with Microsoft Defender Antivirus built in — and it's genuinely good. Independent testing labs (AV-TEST, AV-Comparatives, SE Labs) consistently rank Defender among the top antivirus products since 2018, often matching or beating paid alternatives. Best of all, scanning is 100% local and free.

1. Right-click the downloaded file in File Explorer.
2. Select "Scan with Microsoft Defender" from the context menu. (On older Windows versions, this appears as "Scan with Windows Defender".)
3. Wait for the scan — usually 5–15 seconds depending on file size.
4. Review the result. If a threat is detected, Defender quarantines the file automatically and shows the threat name (e.g., "Trojan:Win32/Wacatac.B!ml" or "Adware:Win32/Linkury").

For a more thorough scan covering multiple files or an entire folder, open Windows Security → Virus & threat protection → Scan options → Custom scan, then select the folder containing your downloads.

Method 3: Malwarebytes Free

Malwarebytes Free is a complementary scanner that excels at detecting potentially unwanted programs (PUPs), adware, search hijackers, and bundled installers — the kinds of low-grade nuisances that Microsoft Defender often ignores because flagging them creates customer friction with legitimate software vendors.

1. Download Malwarebytes Free from the official website (don't use third-party mirrors — supply-chain risk applies here too).
2. Install and launch. The free version doesn't include real-time protection (that's a Premium feature), but on-demand scanning is unlimited and free forever.
3. Click "Scanner" → "Custom Scan" and select the folder containing your downloaded file.
4. Review the threat list. Malwarebytes categorises detections as Malware (genuine threats), PUP (Potentially Unwanted Programs), or PUM (Potentially Unwanted Modifications).

Method 4: Hybrid Analysis (Behaviour Sandbox)

For suspicious files where VirusTotal returns ambiguous results, Hybrid Analysis (operated by CrowdStrike) provides full behavioural sandboxing. Instead of just running antivirus signatures, it executes your file in an isolated virtual machine and reports every system call, network connection, file modification, and registry change.

1. Upload the file at hybrid-analysis.com (free registration may be required for some features).
2. Choose an analysis profile — Windows 10 64-bit is the default for most Windows executables.
3. Wait 2–10 minutes for the sandbox to execute the file, observe its behaviour, and generate a comprehensive report.
4. Review the threat score (0–100), MITRE ATT&CK technique mapping, dropped files list, and IOC (Indicators of Compromise) summary.

This level of analysis is overkill for routine scanning but invaluable when you have a borderline detection from VirusTotal and need to understand what the file actually does when executed — not just whether engines pattern-match it.

Method 5: Hash Verification

If a software publisher provides an official SHA-256 or MD5 hash on their download page (most reputable open-source projects do), comparing your downloaded file's hash against the published one verifies the file wasn't tampered with in transit and matches what the publisher actually released.

Computing Hashes on Your System

Windows (Command Prompt):

certutil -hashfile "C:\Downloads\yourfile.exe" SHA256

Windows (PowerShell):

Get-FileHash "C:\Downloads\yourfile.exe" -Algorithm SHA256

macOS / Linux Terminal:

shasum -a 256 yourfile.dmg

In your browser (no command line needed): Use the File Inspector at the top of this page — it computes both SHA-256 and MD5 locally without uploading.

How to Interpret Antivirus Scan Results

Reading antivirus results requires nuance. Modern AV uses heuristics, machine learning, and behavioural analysis — all of which produce false positives. A single detection doesn't automatically mean malware, and zero detections don't guarantee safety. Here's how to read VirusTotal-style multi-engine results:

Common False Positive Patterns

• "Generic.Heur.*" or "Trojan.Generic" — heuristic detection without a specific threat signature. Often false positives from pattern-matching against malware-like behaviour.
• "Unsafe" or "Suspicious" from Bkav, Cylance, MaxSecure, Jiangmin — these engines have notoriously high false-positive rates in independent testing.
• Installers and self-extractors (NSIS, Inno Setup, packed executables) commonly trigger 1-3 false positives because the installer/wrapper format itself is associated with malware distribution.
• Keygens, patches, and crack tools almost always trigger detections regardless of actual maliciousness, because their behavioural patterns (writing to system files, modifying executables, generating license keys) overlap with malware patterns. This is unavoidable due to how those tools work.
• Recently-compiled software (within last 24 hours) often triggers detections that disappear within a few days as engines update their reputation databases.

SHA-256 vs MD5 — What's the Difference?

Both SHA-256 and MD5 are cryptographic hash functions — algorithms that take a file of any size as input and produce a fixed-length fingerprint string as output. Two files with the same content will always produce the same hash; even a single bit of difference produces a completely different hash.

The File Inspector computes both because some download pages still publish only MD5 checksums (for backward compatibility), and you may want to verify both match the publisher's stated values. For security-critical verification, always prefer SHA-256.

10 Red Flags That Indicate Malware

Before scanning, these warning signs alone should make you pause and double-check before running the file:

1. The download arrived as an unexpected email attachment — even from someone you know. Email accounts get compromised, and contacts get spoofed.
2. The filename has a double extension like document.pdf.exe or invoice.docx.scr. This is a classic disguise — the executable is the real file, the document extension is the bait.
3. The file size is wildly different from what the publisher's page states. A 150 KB "installer" for software that's normally 80 MB is almost certainly a downloader stub for malware.
4. The file is digitally unsigned when the publisher's other releases are signed. Right-click → Properties → Digital Signatures on Windows shows this.
5. The download URL redirects through obscure intermediaries or uses URL shorteners. Legitimate publishers use direct, branded download URLs.
6. The publisher's site uses HTTP instead of HTTPS, or has a recently-registered domain (check via whois).
7. The site asks you to disable your antivirus "to prevent false positives" or "for proper installation". Legitimate publishers never ask this.
8. The file is named like the legitimate product but downloaded from a third party site that's not the publisher's domain (e.g., "Adobe Photoshop installer.exe" from a forum link).
9. The file's icon doesn't match its extension — e.g., a file with a Word icon that's actually an .exe.
10. Windows SmartScreen or your browser warns you when downloading. These warnings exist for a reason — heed them.

Preventing Infection Before You Download

Defense-in-depth means catching threats at multiple layers. Beyond scanning downloads after the fact, these habits dramatically reduce your overall risk profile:

• Keep your operating system fully updated. Windows Update, macOS Software Update, Linux package manager — most malware exploits known vulnerabilities for which patches already exist.
• Use a reputable browser (Chrome, Firefox, Edge, Brave) with built-in safe-browsing protection. These warn you before downloading known-malicious files based on Google Safe Browsing or Microsoft SmartScreen databases.
• Enable Windows SmartScreen at maximum sensitivity (Windows Security → App & browser control → Reputation-based protection). This checks downloaded executables against Microsoft's reputation database before letting them run.
• Don't disable User Account Control (UAC). Those prompts asking "do you want to allow this app to make changes?" are your last line of defence against silent malware installation.
• Run unfamiliar software in Windows Sandbox (Windows 10/11 Pro feature, free) or a virtual machine. The sandbox is isolated from your real system and is destroyed when closed — perfect for testing untrusted installers.
• Maintain regular offline backups using external drives that aren't always connected. This is the single best defence against ransomware specifically — you can simply restore rather than pay.
• Use a password manager. If malware does get through and steal saved browser passwords, the damage is limited if those aren't your real passwords.
• Enable two-factor authentication on important accounts (email, banking, work). Even if credentials are stolen, 2FA prevents takeover.

What to Do If You've Already Run a Malicious File

If you suspect or confirm you've executed a malicious file, time matters. Take these steps in order:

1. Disconnect from the internet immediately. Unplug Ethernet, disable Wi-Fi. This prevents the malware from communicating with command-and-control servers, exfiltrating data, or downloading additional payloads.
2. Run a full Microsoft Defender scan. Windows Security → Virus & threat protection → Scan options → Full scan. This can take 30–90 minutes but examines every file on your drive.
3. Boot into Safe Mode (hold Shift while clicking Restart on Windows) and run a second-opinion scan with Malwarebytes Free. Some malware is harder to remove when fully active.
4. Change passwords for important accounts — but do this from a different, known-clean device. Email, banking, social media, work accounts. Enable 2FA if you haven't already.
5. If you handled financial information or banking details on the infected device, contact your bank and freeze affected cards.
6. For ransomware specifically: do not pay. Restore from backups instead. Paying funds further attacks and doesn't guarantee file recovery (~30% of ransomware payments don't result in working decryption).
7. Consider a clean OS reinstall if the infection persists or you can't verify complete removal. Backup your personal files (documents, photos), wipe the drive, and reinstall from a trusted source. This is the only way to be 100% sure.

Frequently Asked Questions