What "Is This Malware" means and why you might need it

When you download a file from the internet — a document, an installer, a compressed folder — you might wonder whether it contains malware before you open it. A malware file checker is a tool that scans a file and compares it against known malicious code to tell you whether it's safe. The most common and reliable one is VirusTotal, a free service run by Google's security division that checks files against 70+ antivirus engines at once.

You don't need a file checker for every download. Your operating system (Windows Defender on Windows, XProtect on Mac) already scans files when you download them. But a file checker becomes useful when you're unsure about a source, when your antivirus is disabled, or when you want a second opinion before opening something that could be important or sensitive.

Key Takeaways

  • VirusTotal is the most widely used free malware checker and scans files against dozens of antivirus engines in seconds.
  • You upload a file to VirusTotal's website or drag it into the browser window; the service never stores your file or shares results with third parties unless you make them public.
  • A clean result from VirusTotal does not may provide a file is safe, because new malware may not yet be in any antivirus database.
  • Your operating system already scans downloads automatically, so a file checker is most useful for files from unfamiliar sources or when your built-in protection is turned off.

How VirusTotal works and what the results mean

VirusTotal's website is virustotal.com. You can upload a file by clicking the upload box, dragging a file into your browser window, or pasting a URL if the file is hosted online. Within seconds to a minute, VirusTotal scans the file against antivirus engines from companies like Avast, Kaspersky, McAfee, and Norton. The results show how many engines flagged the file as malicious and what names they gave it.

A file flagged by one or two engines might be a false alarm — antivirus software sometimes mistakes legitimate files for threats. A file flagged by 10 or more engines is almost certainly malware. The middle ground (three to nine detections) is worth investigating: check the detection names to see if they're consistent, and consider where the file came from. If you downloaded it from a trusted source and only a few obscure antivirus engines flagged it, it's probably safe. If you downloaded it from an email or a suspicious website and multiple engines agree it's malware, delete it.

What VirusTotal does and does not tell you

VirusTotal checks whether a file matches known malware signatures — patterns of code that antivirus companies have already seen and catalogued. This works well for widespread malware, ransomware, and trojans that have been in circulation for weeks or months. It does not catch brand-new malware that was created yesterday and hasn't been added to any antivirus database yet. Security researchers call this a zero-day threat, and no file checker can detect it.

VirusTotal also does not analyze what a file will do once you run it. A file might be technically "clean" — not matching any known malware — but still be unwanted software (called PUPs, or potentially unwanted programs) that slows your computer or tracks your behavior. Some antivirus engines flag PUPs; others don't. Check the detection names to see whether engines are calling something malware or just unwanted.

Privacy and security when using VirusTotal

VirusTotal does not store your file permanently or share it with third parties by default. When you upload a file, VirusTotal scans it, shows you the results, and deletes it after a set period (usually a few weeks). Your upload is not logged in a way that links your identity to the file unless you choose to make the result public by sharing the link.

That said, do not upload files containing sensitive information — passwords, financial records, personal documents, or proprietary code. If a file contains data you don't want exposed, scan it with your own antivirus software instead, or ask the person who sent it to you whether they trust the source. For most everyday downloads (installers, documents, images), VirusTotal is safe to use.

When to use a file checker and when to skip it

Use VirusTotal if you downloaded a file from an unfamiliar website, received it in an email from someone you don't know, or are unsure whether a source is trustworthy. It's also useful if your antivirus software is disabled or outdated, or if you want confirmation before opening something important.

You do not need VirusTotal for files from established sources: software from official websites (Microsoft, Adobe, Slack), documents from your email provider, or files from people you know and trust. Your operating system's built-in scanner has already checked these. If you're downloading from a major app store (Microsoft Store, Mac App Store, Google Play), the store itself has already vetted the software.

Other file checkers and when they're useful

VirusTotal is the standard, but other options exist. Windows Defender (built into Windows) and Malwarebytes both have free versions that scan files on your computer. Kaspersky and Avast offer free antivirus software that runs in the background. These are useful if you want continuous protection rather than checking one file at a time.

Some browsers (Chrome, Firefox, Edge) also warn you before downloading files they recognize as malware. These warnings are based on Google's Safe Browsing database, which is separate from VirusTotal but covers similar ground. If your browser warns you not to download something, that's a strong signal to skip it.

What to do if a file is flagged as malware

If VirusTotal flags a file as malware, delete it immediately. Do not open it, do not try to "clean" it, and do not move it to a quarantine folder hoping to use it later. Malware is designed to spread and hide; the safest action is removal.

If you downloaded the file intentionally from what you thought was a trusted source, contact that source and let them know. The website or person may have been hacked, or the file may have been replaced with malware. If you downloaded it by accident or from a suspicious email, simply delete it and move on. If the file was already on your computer when you checked it, run a full antivirus scan to see whether malware has already spread.

Frequently Asked Questions

Can VirusTotal detect all malware?

No. VirusTotal catches malware that antivirus companies have already seen and catalogued, but it cannot detect brand-new malware created in the last few days. It also may not catch some types of unwanted software that aren't classified as malware. Use it as one layer of protection, not the only one.

Is it safe to upload files to VirusTotal?

For most files, yes. VirusTotal deletes files after a few weeks and does not share them with third parties unless you make the result public. Do not upload files containing passwords, financial information, or other sensitive data.

What does it mean if only one antivirus engine flags a file?

One detection is often a false alarm. Check the detection name to see if it makes sense for the file you uploaded. If multiple unrelated antivirus engines agree, the file is more likely to be malware. When in doubt, delete the file or ask the person who sent it to you.

Do I need VirusTotal if I have antivirus software?

Probably not for everyday use. Your antivirus software scans files automatically. VirusTotal is most useful when you want a second opinion, when your antivirus is disabled, or when you're checking a file from an unfamiliar source.

What should I do if I already opened a file that was flagged as malware?

Run a full antivirus scan immediately using Windows Defender, Malwarebytes, or another antivirus tool. Change your passwords if the file was an email attachment or came from a suspicious source. If the scan finds malware, follow the antivirus software's instructions to remove it.