iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Do not open the downloaded file just to see what it does. First check its filename, location, size, and source, then scan it with Microsoft Defender. For a second opinion, VirusTotal can help—but a normal VirusTotal upload should not be treated as private, and a clean result is not proof that the file is harmless.
The safest workflow is: update Defender, scan the file or its containing folder, review the result in Protection history, and quarantine or delete the file unless you have a specific reason to preserve it.
Before scanning: do not run the file
Leave the suspicious download where it is. Do not double-click it, open it from the browser’s download list, extract an archive, or enable macros in a document. Treat shortcuts, scripts, installers, executables, and password-protected archives with particular caution.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →In File Explorer, right-click the file and select Properties. Check:
#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
- Whether the extension is what you expected. A file named
invoice.pdf.exeis an executable, not a PDF. - The file size and date downloaded.
- The Digital Signatures tab, if present. A signature can identify the publisher, but its presence alone does not prove that the download is appropriate or safe.
- The download source. An unexpected attachment, cracked software package, or fake update deserves more suspicion than a file downloaded directly from a vendor’s official site.
If you already opened the file and the computer is behaving unusually, stop interacting with it. Disconnect the PC from the network if you suspect an active infection, then use another trusted device to change important passwords and seek further help. Do not upload confidential files to a public scanning service.
Scan the file with Windows Security
Microsoft Defender Antivirus is built into current Windows 10 and Windows 11 installations. These Windows Security steps apply to Windows 10 version 1703 and later.
1. Update Defender first
- Open Windows Security from the Start menu.
- Select Virus & threat protection.
- Find Virus & threat protection updates and select Check for updates.
Microsoft now calls the former “definition version” the security intelligence version. Updating before a scan matters because malware detection depends partly on current security intelligence.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Run a quick scan
- Stay on the Virus & threat protection page.
- Select Quick scan.
- Wait for the scan to finish and note whether Windows reports a threat.
A quick scan is useful as an initial check, but it is not a complete examination of every file on the drive. Passing a quick scan does not establish that a file is safe.
3. Use a full or custom scan when appropriate
Select Scan options on the same page. Depending on your Windows configuration, you can choose Full scan or another listed scan type, then start the scan.
A full scan checks much more of the system and can take substantially longer. If you are concerned about a downloaded folder or several related files, a custom scan is more targeted than a quick scan. If Windows Security does not offer the control you expect, the computer may be managed by Group Policy; settings deployed that way can appear gray or unavailable.
Check the result in Protection history
- Open Windows Security.
- Select Virus & threat protection.
- Select Protection history.
This page shows detections and actions taken by Defender. Read the action carefully. A detection may have been blocked, quarantined, removed, or require additional action. If a file is quarantined, do not restore it merely because you recognize its filename.
| Result | What to do |
|---|---|
| No current threat reported | Do not interpret this as a guarantee. Use a full or custom scan if the file remains suspicious, and consider an independent second opinion. |
| Threat quarantined | Leave it quarantined unless you have verified a false positive and understand the risk of restoring it. |
| Threat removed | Review Protection history and run another scan. If the file was executed, investigate the system rather than assuming removal solved everything. |
| Action required | Follow the action shown in Windows Security. Do not dismiss the alert without understanding what Defender found. |
Confirm that real-time protection is on
To check Defender’s real-time setting, open:
Windows Security → Virus & threat protection → Virus & threat protection settings → Real-time protection
Rank #2
- Solid state performance with up to 800MB/s read speeds in a portable drive. (Based on internal testing; performance may be lower depending on host device, interface, usage conditions and other factors. 1MB=1,000,000 bytes.)
- Back up your content and memories on a storage solution that fits seamlessly into your mobile lifestyle.
- Take it with you on your adventures—up to two-meter drop protection means this durable drive can take a beating. (Based on internal testing.)
- Secure it to your belt loop or backpack for extra peace of mind thanks to the tough rubber hook.
- From Sandisk, a brand professional photographers trust to take on assignments.
The switch should be On. If another antivirus product is installed and kept up to date, Microsoft Defender Antivirus normally disables itself or enters passive operation. Windows Security may instead show limited periodic scanning. That behavior is expected when another antivirus product is the primary protection.
Run a scan from PowerShell
For a normal Defender scan, open PowerShell and run:
Start-MpScanStart-MpScan uses the configured scan behavior unless you supply additional parameters. Microsoft’s current documentation does not present it as a guaranteed single-file scan command. For one specific file or folder, use MpCmdRun.exe as described below.
Scan one file or folder from Command Prompt
A custom scan is useful when you want to check a downloaded item without requesting a full system scan.
1. Open an elevated Command Prompt
- Open Start and type cmd.
- Right-click Command Prompt.
- Select Run as administrator.
MpCmdRun.exe is not normally included in the system PATH. Running it from an arbitrary Command Prompt commonly produces “MpCmdRun is not recognized as an internal or external command.” First change to the Defender installation directory.
2. Select the current Defender platform directory
Paste this command into the elevated Command Prompt:
(set "_done=" & if exist "%ProgramData%MicrosoftWindows DefenderPlatform" (for /f "delims=" %d in ('dir "%ProgramData%MicrosoftWindows DefenderPlatform" /ad /b /o:-n 2^>nul') do if not defined _done (cd /d "%ProgramData%MicrosoftWindows DefenderPlatform%d" & set _done=1)) else (cd /d "%ProgramFiles%Windows Defender")) >nul 2>&1This selects the newest platform-version directory when it exists, otherwise it uses:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
C:Program FilesWindows DefenderThe possible platform location is:
C:ProgramDataMicrosoftWindows DefenderPlatform<antimalware platform version>3. Scan the suspicious item
Replace the example path with the full path to the file or folder:
Rank #3
- Capacity Display Variance: 500GB external ssd often appears as around 465GB on Windows. MacOS can show full 500 GB capacity. This is binary calculation difference and doesn’t affect SSD hard drive actual physical storage
- 1050 MB/s Speed: Instantly access to your files with blazing-fast 10Gbps external SSD read up to 1050MB/s and write up to 1000MB/s. LED Light indicates USB SSD instant activity
- Data Security: Solid state drives S.M.A.R.T. health diagnostics and adaptive TRIM optimizing data block management ensures consistent write speeds and extends the longevity of the portable SSD
- USB-C & USB-A Cable: Both cables featuring rapid USB 3.2 Gen2, this USB SSD effortlessly bridges devices, enabling seamless cross-platform file transfers and backup between computers, smartphones, tablets and iPhone
- Always Fast: No slowdowns for large file transfers. With SLC caching (25% of current available capacity allocated as high-speed cache), this external SSD delivers steady 10Gbps for transfers within the cache capacity
MpCmdRun.exe -Scan -ScanType 3 -File "C:pathtosuspicious-file"-ScanType 3 means a custom scan, and -File accepts either a file path or a folder path. Quote paths containing spaces, for example:
MpCmdRun.exe -Scan -ScanType 3 -File "C:UsersAlexDownloadsInvoice 2025.exe"For reference, the other scan types are:
MpCmdRun.exe -Scan -ScanType 1This starts a quick scan.
MpCmdRun.exe -Scan -ScanType 2This starts a full scan.
With no scan type specified, MpCmdRun.exe -Scan normally performs a quick scan unless a different default has been configured. The default timeout is one day for a quick scan and seven days for a full scan; the maximum -Timeout value is 30 days.
Understand the command’s return code
Do not treat the final numeric return code as a complete verdict. A return code of 0 can mean that no malware was found, but it can also mean malware was found and successfully remediated. A return code of 2 can indicate that malware was not remediated, that user action is required, or that a scanning error occurred.
When you need the actual HRESULT rather than the generic result, add -ReturnHR:
MpCmdRun.exe -Scan -ScanType 3 -File "C:pathtosuspicious-file" -ReturnHRFor the human-readable outcome and remediation details, also check Windows Security → Virus & threat protection → Protection history.
Scan without applying remediation
If you need to examine a sample without allowing Defender to apply its normal detected-threat action, you can use:
MpCmdRun.exe -Scan -ScanType 3 -File "C:pathtosuspicious-file" -DisableRemediationUse this option carefully. With -DisableRemediation, exclusions are ignored, archives are scanned, remediation actions are not applied, event-log entries are not written after detection, detections are not displayed in the Windows user interface, and detections are shown in the command output. It is generally unsuitable for routine protection: if you simply want the suspicious file dealt with, use a normal scan instead.
Use VirusTotal for a second opinion
VirusTotal compares an uploaded file with multiple security products and analysis services. It can reveal that several engines recognize a known threat, or that one engine has flagged a file that Defender did not. It is a second opinion, not a certificate of safety.
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Do not upload sensitive files to the ordinary service
A standard VirusTotal submission should not be described as private. Do not upload tax documents, customer data, company code, credentials, unreleased software, private photographs, or other confidential material merely to check it.
The documented legacy direct-upload endpoint accepts files up to 32 MB:
https://www.virustotal.com/vtapi/v2/file/scanFiles up to 200 MB require the /file/scan/upload_url endpoint. The upload API returns a queued scan/report resource; a result showing zero detections is not defined as a guarantee that the file is benign.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Private scanning is a separate product path
VirusTotal’s private-scanning API uses a different endpoint:
https://www.virustotal.com/api/v3/private/filesIt requires an API key in the x-apikey header. Files over 32 MB use /private/files/upload_url, and private scanning supports files up to 650 MB. The documented service supports retention periods from one to 28 days, with the group policy applying when no period is supplied, and allows US or EU storage regions.
Private scanning can accept a protected ZIP with a password. Its sandbox options default to no sandbox detonation and no Internet access. Those details make it materially different from an ordinary public submission, but you should still check the account’s terms and retention settings before uploading sensitive material.
What a clean scan actually means
“No threats found” means the selected scanner did not identify the item using its current detection and analysis capabilities. It does not prove that the file is safe. Malware can be new, obfuscated, encrypted, dormant, or designed to evade a particular scanner. A quick scan also examines a different scope from a full or custom scan.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Use the following decision process:
- Was the file unexpected? Delete it without opening it if you have no legitimate reason to keep it.
- Did Defender detect it? Leave it quarantined or follow the recommended removal action.
- Did Defender find nothing but the source is suspicious? Run a custom or full scan and use a second opinion without exposing confidential data.
- Did several reputable scanners flag it? Do not run it. Remove it or preserve it only for controlled incident analysis.
- Was it a legitimate file falsely detected? Verify its origin, publisher, hash or release information, and submit it to the software vendor or Microsoft for false-positive review rather than immediately restoring it.
View or restore quarantined files
The normal Windows Security route is:
Virus & threat protection → Protection history
Filter for Quarantined Items, select the detection, and choose an available action such as Restore. Restore only after you have independently established that the detection is a false positive. Restoring malware can make the system vulnerable again.
Best Value
- MADE FOR THE MAKERS: Create; Explore; Store; The T7 Portable SSD delivers fast speeds and durable features to back up any endeavor; Build your video editing empire, file your photographs or back up your blogs all in an instant
- SHARE IDEAS IN A FLASH: Don’t waste a second waiting and spend more time doing; The T7 is embedded with PCIe NVMe technology that brings fast read and write speeds up to 1,050/1,000 MB/s¹, making it almost twice as fast as the T5
- ALWAYS MAKE THE SAVE: Compact design with massive capacity; With capacities up to 4TB, save exactly what you need to your drive – from large working files to game data and everything in between
- ADAPTS TO EVERY NEED: Whether using a PC or mobile phone, count on the T7 for extensive compatibility²; It’s a true team player when it comes to heavy-duty application usage or file-saving
- HI RESOLUTION VIDEO RECORDING: Record Ultra High Resolution (4K 60fs) videos directly onto the T7 Portable SSD with your favorite camera or mobile devices; Supports iPhone 15 Pro Res 4K at 60fps video and more³
From an elevated Command Prompt, list quarantined items with:
MpCmdRun.exe -Restore -ListAllRestore an item by threat name with:
MpCmdRun.exe -Restore -Name <filename>To restore it to a specified path while leaving it in quarantine:
MpCmdRun.exe -Restore -Path "C:safereview-locationfile.exe"Without -Path, restoration returns the item to its original location and removes it from quarantine. The command-line restore options have the same risk as the Windows Security Restore action: use them only when you have a reason to override Defender.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhen to escalate
Get specialist help if the file was executed and you see new accounts, disabled security tools, repeated detections, unknown browser extensions, unexplained outbound traffic, ransom demands, encrypted files, or persistent pop-ups. A single scan is not a substitute for incident response after a suspicious program has run.
For a potentially compromised work computer, contact your organization’s IT or security team before deleting evidence or reinstalling software. For a personal computer, preserve relevant alert details and consider a second trusted-device password change, account review, and a clean recovery or reinstall if compromise cannot be confidently ruled out.
FAQ
Can I scan a downloaded file without opening it?
Yes. Use Windows Security’s scan options or run MpCmdRun.exe -Scan -ScanType 3 -File "full\path\to\file" from an elevated Command Prompt. Do not double-click the file first.
Is a quick scan enough to prove a file is safe?
No. Quick, full, and custom scans cover different scopes, and no antivirus result is an absolute guarantee. Use a custom or full scan when the source or behavior remains suspicious.
Recommended Free Tools
Why does Windows say MpCmdRun.exe is not recognized?
The Defender directory is not normally in PATH. Change to C:\Program Files\Windows Defender or the current platform directory under C:\ProgramData\Microsoft\Windows Defender\Platform before running the command.
Is uploading a file to VirusTotal private?
Not by default. Ordinary VirusTotal submission and private scanning are separate paths. Do not upload confidential files to the standard service; private scanning uses its own API endpoint, API key, limits, and retention settings.
Should I restore a file that Defender quarantined?
Only if you have verified a false positive through trustworthy evidence, such as the original vendor and release information. Otherwise leave it quarantined or remove it.
The Bottom Line
Keep the download closed, update Defender, and scan it through Windows Security → Virus & threat protection. For a single item, use an elevated Command Prompt with MpCmdRun.exe -Scan -ScanType 3 -File. Review Protection history instead of relying only on a command return code. Use VirusTotal cautiously: an ordinary upload is not private, and zero detections do not guarantee that the file is safe.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
