Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes, antivirus can scan many .7z and .rar archives, including with Microsoft Defender, but a clean result is not proof that every file inside is safe. The safest approach is to keep real-time protection enabled, update security intelligence, verify the archive’s source, scan it before extraction, and scan the extracted folder before opening anything. Password-protected archives deserve extra caution because encryption can prevent inspection and is a known malware-delivery technique.
What antivirus can and cannot tell you about 7z and RAR files
A 7z or RAR file is a container. It may hold photographs and documents, or it may contain an installer, script, shortcut, macro-enabled document, or another file designed to run malicious code. Antivirus software can often open the container internally and inspect at least some of its contents. Microsoft’s Defender exclusion guidance specifically lists .7z and .rar among file extensions that should not be excluded from scans.
Microsoft also states that, with real-time protection enabled, Microsoft Defender Antivirus runs in the background and scans files and processes that you open or download. That protection is useful when an archive arrives by email, appears in Downloads, or is copied from removable storage. It is not a guarantee: scanning engines have limits, and a threat can be hidden by encryption, obfuscation, or a newly created malware variant.
| Situation | What a scanner may do | What you should conclude |
|---|---|---|
| Unencrypted 7z or RAR | Inspect the archive and identify known malicious files or suspicious behavior indicators. | A detection is a strong warning. A clean result means only that nothing was detected under that scan. |
| Password-protected archive | May be unable to inspect the encrypted payload without the password. | Encryption is a reason to slow down, not evidence of legitimacy. |
| Archive containing a new or obfuscated threat | Signature and behavior-based checks may fail to recognize it. | Do not treat “no threats found” as a safety certificate. |
| Archive after extraction | Real-time protection can inspect files as they are created or opened, and you can run an on-demand scan of the folder. | Scan the extracted folder before opening individual files. |
The practical rule is simple: antivirus detection is evidence, not a verdict about the sender, the request, or every future action you might take with the contents.
Popular on Amazon
Can Windows Defender scan a .7z or .rar file?
Yes. Windows Defender is designed to scan files you download or open, and Microsoft advises not excluding 7z or RAR extensions. You can also start a scan directly from File Explorer before extracting the archive.
Scan the archive from File Explorer
- Leave Microsoft Defender real-time protection turned on. Do not disable it to make an archive open or extract.
- Open File Explorer and locate the
.7zor.rarfile. - Right-click the archive. On Windows 11, select Show more options if the compact menu does not display the Defender command.
- Choose Scan with Microsoft Defender and wait for the result.
- If Defender reports a threat, follow Windows Security’s quarantine or removal action. Do not extract the archive to “see what it is.”
If the scan option is missing, check that Microsoft Defender is active and that another antivirus product has not taken over real-time protection. A missing context-menu command does not mean the archive is safe; use Windows Security to run an on-demand scan instead.
Update protection before a deeper check
When an archive is unexpected or you suspect unwanted software, update Microsoft Defender security intelligence before running a full scan. In Windows Security, open Virus & threat protection, check for protection updates, and then select Scan options and Full scan. Security intelligence that is out of date can reduce the chance of recognizing recently identified threats.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhy a clean archive scan is not a guarantee
Encryption can hide the payload
A password-protected archive encrypts its contents. Unless the scanner can obtain and use the password, it may be unable to inspect the files inside. CISA’s #StopRansomware guidance warns that malware is often compressed in password-protected archives that evade antivirus scanning and email filters. This is why an encrypted attachment accompanied by a password in the same message should be treated as suspicious, even when the message looks polished.
Also popular on Amazon
Detection engines can miss new or disguised malware
Antivirus products use signatures, reputation data, heuristics, and behavioral checks. Those methods are powerful but not infallible. A previously unseen threat or one deliberately disguised to resemble a document may not trigger a detection. “No detection” describes the result of that scan at that time; it does not establish that the sender is trustworthy or that every file will behave safely when opened.
The harmful action may happen after extraction
An archive can appear harmless while a file inside it becomes dangerous when launched. An executable, script, shortcut, installer, or macro-enabled document deserves separate scrutiny. Keep real-time protection enabled, scan the extracted directory, and do not open a file merely because the archive utility displayed it successfully.
Use this safe opening sequence
Follow these steps for an archive you genuinely need. If the file was unexpected, stop at the verification step until the sender confirms it through a trusted channel.
- Keep protection enabled. Do not turn off real-time protection and do not create a 7z or RAR exclusion. Microsoft warns that while protection is off, newly opened or downloaded files may not be scanned until a later scan.
- Update security intelligence. In Windows Security, check for the latest protection updates before a full or on-demand scan, particularly if unwanted software is suspected.
- Verify the source independently. Contact the purported sender using a phone number, chat account, or website you already trust. Do not rely on the filename, display name, logo, or a password included in the same email. If you downloaded the archive, confirm that you used the organization’s genuine website or transfer channel.
- Scan before extraction. Right-click the archive in File Explorer, select Show more options when necessary, and choose Scan with Microsoft Defender. A detection means you should quarantine or delete the file rather than continue.
- Treat encryption as a warning. If the archive asks for a password, do not enter it simply because the message tells you to. Confirm why encryption is needed and who supplied the file. An unexpected encrypted archive should be escalated to the sender or your IT team.
- Extract into a dedicated folder. Use a new folder rather than mixing the contents with your Documents or Downloads folders. This makes the next scan and any cleanup easier.
- Scan the extracted folder. Right-click the folder and run a Microsoft Defender scan before opening a document or launching a program inside it. Keep the archive and extracted files together until verification is complete so you can remove both if necessary.
- Open only what you expect. Do not launch an executable, script, shortcut, installer, or macro-enabled document solely because it was included in an archive. If the sender promised photographs but the folder contains a program, stop and verify the discrepancy.
How to check a RAR file before extracting it
Confirm the context
Ask whether you were expecting a RAR file, whether the sender normally uses archives, and whether the file name and size make sense for the stated contents. A familiar name is not authentication: attackers can spoof names, hijack accounts, or forward a genuine-looking message.
Also popular on Amazon
Inspect without opening payloads
An archive utility can show a file listing, but viewing a listing is not the same as safely opening a file. Look for unexpected extensions such as .exe, .scr, .bat, .cmd, .js, .vbs, shortcuts, installers, or macro-enabled Office documents. Their presence is not automatic proof of malware, but it changes the verification question: why is that file needed?
Scan at both stages
Run an on-demand scan while the archive is still compressed, then run another scan on the extracted folder. The second check matters because the files now exist individually and can be evaluated as they are created or opened. Never assume that a successful extraction operation performed a complete malware check.
Ask for a safer replacement when appropriate
If a sender can provide the same material through a trusted portal or as ordinary, separately scanned files, that may remove the need to handle an encrypted attachment. This is especially sensible when the sender cannot explain the password or when the archive arrived unexpectedly.
Recommended Free Tools
Are password-protected archives safe?
Password protection is a security feature in legitimate workflows, but it is not a trust signal. Encryption can prevent antivirus and email filters from inspecting the contents, which is why attackers use it to deliver malware. The password itself can be harmless, yet the file behind it can still be malicious.
Also popular on Amazon
- Do not enter a password supplied in an unsolicited message until the sender is independently verified.
- Do not disable antivirus, create an exclusion, or move the archive to another device to get around a scan.
- Ask the sender what files are inside, why encryption is required, and how the password was communicated.
- After legitimate verification, extract to a separate folder and scan that folder before opening anything.
What to do if you already opened a suspicious archive
If you only viewed the archive
Close the archive utility, do not open any listed files, and run an updated full scan. Keep real-time protection enabled. If the archive was unexpected, preserve the message and file details for your IT administrator or security team rather than forwarding the attachment to other people.
If you extracted files but did not launch them
Stop using the extracted files, disconnect the archive from shared folders, and scan the extracted directory with updated security intelligence. Quarantine or delete anything detected. Do not re-open the files while waiting for the scan result.
If you launched a program, script, shortcut, installer, or macro
Disconnect the device from the network if doing so is consistent with your organization’s incident procedure, then contact IT or your security team. Run an updated full scan. If unwanted software persists or the machine behaves abnormally, use Microsoft Defender Offline from Windows Security’s Virus & threat protection area and follow the restart prompt. An offline scan can check before normal Windows processes fully load.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Watch for signs that require escalation
- Unexpected pop-ups, new browser extensions, or security settings that changed without your approval.
- Unknown processes, disabled protection, unfamiliar user accounts, or files appearing in system folders.
- Unusual network traffic, rapid file renaming or encryption, or messages sent from your account without you sending them.
- Repeated detections after rebooting or after a full scan.
Do not assume that deleting the archive reverses an action that already ran. If credentials may have been entered, change them from a known-clean device and notify the relevant service or administrator.
Also popular on Amazon
What to look for when comparing antivirus tools
If you are evaluating security software, compare the capabilities that matter for archives rather than relying on a single “archive scan” label.
| Capability | Questions to ask | Why it matters |
|---|---|---|
| Archive handling | Does the product scan 7z and RAR containers, and does it inspect nested archives? | A product that ignores a format leaves a gap before extraction. |
| Encrypted-content handling | How does it report an archive it cannot decrypt? | The result should make the inspection limitation clear rather than implying a clean verdict. |
| Real-time protection | Does it monitor downloads, extraction, and file execution? | Threats can appear after the original archive scan. |
| On-demand, full, and offline scans | Can you scan one archive, the whole device, and an environment outside normal Windows? | Different stages are useful for different exposure scenarios. |
| Update process | How frequently are security intelligence updates delivered, and can you force an update? | Current definitions improve recognition of recently identified threats. |
| False-positive controls | Can a suspected file be quarantined and restored only after review? | Reviewable quarantine is safer than automatically allowing a questionable file. |
| Sample submission | Is there a documented way to submit a suspicious archive for analysis? | Microsoft provides a file-submission workflow for suspicious archives, which can help when a result is uncertain. |
No feature list removes the need to verify the source and avoid launching unexpected contents. Technical scanning and sensible handling work together.
Common mistakes to avoid
- Disabling real-time protection temporarily: Newly opened or downloaded files may go unscanned while protection is off.
- Adding an exclusion for convenience: Excluding
.7zor.rarcreates a predictable blind spot that attackers can exploit. - Trusting a password: Encryption can block inspection; it does not establish who created the archive.
- Scanning only after opening a file: Scan the archive and extracted folder first.
- Assuming a known sender is safe: Accounts can be compromised and display names can be forged. Verify unexpected transfers through another channel.
- Stopping after a quick scan: Update protection and run a full scan when exposure may have occurred; use an offline scan if suspicious behavior persists.
Bottom line for 7z and RAR safety
Microsoft Defender and other antivirus engines can inspect many 7z and RAR files, but detection is never a guarantee that an archive is safe. Encrypted archives can hide their contents from scanners, and a harmless-looking container can release a dangerous file when extracted. Keep real-time protection enabled, update security intelligence, verify the source independently, scan before and after extraction, and escalate promptly if anything suspicious was opened.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
