How to Check if a File Is Safe Before You Open It

Most malware does not break into your computer. It gets invited in: someone sends a file, it looks harmless, and you open it. The good news is that a minute of checking before you double-click stops the vast majority of these attacks.

Here is the routine we recommend for any file you download, whether it came from a file host, a Discord message, an email attachment or a game forum.

The one-minute safety check

1. Ask whether you expected it. A file you asked for from someone you know is low risk. A file that arrives out of the blue, especially with pressure attached ("open this now", "is this you in this video?"), is the classic setup. Hacked accounts are often used to send malware to friends, so an unexpected file from a friend still counts as unexpected.
2. Show the real file extension. Windows hides known extensions by default, which is how "holiday-photos.jpg.exe" ends up looking like "holiday-photos.jpg". Turn them on in File Explorer: on Windows 11 go to View, then Show, then File name extensions; on Windows 10 tick File name extensions on the View tab.
3. Know which file types can run code. Treat .exe, .scr, .msi, .bat, .cmd, .ps1, .vbs, .js, .jar and .lnk files with suspicion, along with disk images (.iso, .img) and Office files with macros (.docm, .xlsm). A "photo", "PDF" or "video" with one of these extensions is a lie.
4. Be wary of password-protected archives. Attackers zip malware with a password so that email filters and scanners cannot look inside. Legitimate files rarely need that, except for genuinely private documents shared between people who know each other.
5. Check it with VirusTotal. VirusTotal checks a file against dozens of antivirus engines for free. Files you upload there can be shared with security researchers, though, so never upload private documents. Instead, search for the file's fingerprint (its SHA-256 hash): in PowerShell run Get-FileHash .\yourfile.zip, on macOS run shasum -a 256 yourfile.zip in Terminal, then paste the hash into VirusTotal's search box.
6. Scan it locally. On Windows, right-click the file and choose Scan with Microsoft Defender (on Windows 11 it may be under Show more options). On a Mac, take Gatekeeper's warnings about apps from unidentified developers seriously instead of clicking past them.
7. Open it somewhere disposable if you are still unsure. Windows Sandbox, built into Windows 11 Pro and Enterprise, gives you a throwaway desktop that is wiped when you close it. For documents, opening them in your browser's built-in viewer is safer than opening them in desktop Office with editing enabled.

Red flags that should stop you

• The message pushes urgency or a reward: free Nitro, a game to "test", a prize, a job offer with an attached "brief".
• The icon does not match the extension, for example a PDF icon on a file ending in .exe.
• The file asks you to disable your antivirus, or a document asks you to click "Enable content" or "Enable editing".
• The size makes no sense: a full movie that is 2 MB, or a "screenshot" that is 40 MB.
• The sender's account is acting out of character, such as a friend who suddenly writes in another language or sends the same message to everyone.

What a clean scan does and does not mean

Zero detections on VirusTotal is a good sign, not a guarantee. Brand-new malware can go undetected for hours or days until antivirus vendors catch up. The opposite also happens: one or two detections from lesser-known engines on an otherwise clean result can be a false positive, especially for small indie tools and game mods. Weigh the scan together with where the file came from. A clean scan of a file from a stranger pushing you to run it right now is still a reason to wait.

How InvisHosting checks every upload

Every file uploaded to InvisHosting goes into quarantine first and is checked with VirusTotal before any download link works. Files that are flagged are blocked, and every file page has a "Report this file" button so that anything suspicious reaches us quickly. We explain the whole pipeline in How We Defend Against Malware Uploads.

That scanning lowers the risk, but no scanner catches everything, which is why the checks above still matter for files from any source, including ours.

If you already opened something suspicious

Disconnect the computer from the internet, then run a full scan. On Windows, the Microsoft Defender Offline scan (Windows Security, then Virus and threat protection, then Scan options) can catch threats that hide while Windows is running. From a different, clean device, change the passwords of your important accounts, starting with your email, and turn on two-factor authentication. On Discord, log out of all devices from the Devices section of your settings, because stolen login sessions are a common goal of this kind of malware.

If the file came from InvisHosting, report it from its file page so we can remove it and protect the next person. We read every report.