How to Scan Downloads for Viruses: A Workflow That Catches Real Threats

Double-clicking straight from the browser is the single riskiest habit on Windows. This is a repeatable check that takes about two minutes per file.

Antivirus software catches most known threats, but it is one opinion, not a verdict. A short, disciplined workflow around the folder where downloads land will catch far more than real-time protection alone, and it costs you a couple of minutes per file once it becomes a habit.

Set up one landing folder

Point your browser at a single dedicated folder instead of the desktop, so nothing gets run by reflex. Enable file name extensions in the Explorer view menu, keep hidden files visible, and turn on the built-in reputation check for unknown applications. Those three switches make most disguised files obvious before you open anything.

The workflow

1. Look at the file name and type first. Any file with two extensions such as a document or image name ending in an executable extension is hostile by default.
2. Check the size against what the publisher states. Attackers rarely match it, and truncated payloads are a common clue.
3. Right-click, open file properties, and check the digital signature tab. A valid signature from the expected publisher is the strongest cheap signal available.
4. Run a scan of the archive or installer with your installed antivirus before the file touches the rest of the system.
5. Compute the file hash and search the hash on a multi-engine online scanner. Uploading the hash leaks nothing, and it tells you whether dozens of engines agree.
6. Upload the actual file only if the hash is unknown and the file is not private. Otherwise test it inside a disposable virtual machine with networking disabled.
7. Extract archives into a folder inside that sandbox and scan the extracted contents, not just the container. Malware inside an archive is invisible to some scanners.

Judging the results

• One detection out of sixty engines is usually a heuristic false positive on an installer or patch tool, but verify with the publisher before dismissing it.
• Several detections naming the same family, especially from independent engines, means delete it and find another source.
• A clean result is not proof. Freshly built malware can score zero until the signature database catches up.
• If your antivirus removed a file during or after install, do not re-download the same build and disable protection to make it work.

Know the limits

Scanning cannot see inside an encrypted installer, cannot judge intent, and says nothing about an otherwise legitimate tool that ships unwanted extras. Reputation comes from more than a scanner: publisher, signature, community reports and whether the file really needs administrator rights.

If something did get through

Disconnect from the network, run a full scan, check startup entries and scheduled tasks for anything you do not recognize, then change the passwords that were stored in the browser. If the machine was logged into banking or work accounts, treat the infection as a credential leak, not just a file problem.