Scan an archive for viruses
Check a ZIP, RAR, 7z or tar.gz before you open it. Every file inside is scanned for known malware, Office macros and shortcuts are opened up to see what they would do, and the archive itself is checked for zip bombs and other tricks. Nothing is extracted to disk and nothing is uploaded.
How to scan an archive for viruses
- Drop the ZIP, RAR, 7z or other archive onto the box above. If its files are encrypted, you can enter the password to scan them too.
- The scanner opens the archive in your browser, including archives inside it, and checks every file. The structure check appears first; malware results stream in as each file is scanned.
- Read the verdict and the list of what was checked. Every finding explains in plain words what the file does. Use the VirusTotal links for a second opinion from about 70 antivirus engines.
What the scan looks for
Known malware
Files are scanned by YARA-X, the engine VirusTotal uses, with about 5,900 openly licensed detection rules from ReversingLabs, Malpedia, Florian Roth's Signature Base, SEKOIA, ditekSHen and others, collected by YARA Forge. A match names the malware family and the rule's author. Programs, scripts and documents are scanned first.
Malicious documents and shortcuts
Most malware sent in archives is not a program but a document or shortcut that downloads one. The scanner opens these files and looks at what they would do:
- Office macros in .doc, .xls, .ppt, .docm, .xlsm and other files: the macro code is decompressed and read. Code that runs on open and downloads files, starts programs or calls Windows memory functions is flagged, along with the web addresses it contains. The code is also scanned with the malware rules.
- Excel 4.0 macros, especially hidden ones that run on open, and DDE fields that start commands without any macro.
- Remote templates and objects that a document fetches when opened, including the "Follina" trick (CVE-2022-30190).
- Programs packed inside documents as clickable icons, old Equation Editor exploits in RTF and Office files, and password-protected documents that hide their contents.
- Windows shortcuts (.lnk) that run PowerShell, cmd or mshta, including commands padded with spaces to hide them, and internet shortcuts (.url) that open a program on another computer.
- OneNote notebooks with a program or script hidden behind a picture, and PDFs with launch actions or program attachments.
Booby-trapped archives
The archive itself is checked for zip bombs, files that would be written outside the folder you extract to (Zip Slip), programs disguised as documents with double extensions or hidden right-to-left characters, and tampered ZIP headers. The Zip Bomb Checker page explains these in detail.
VirusTotal lookups
Every file, including files in nested archives, gets a SHA-256 fingerprint computed in your browser. Programs, scripts, macro documents and nested archives are listed with a VirusTotal link, and every file has one in the table. Clicking a link sends only that fingerprint, never the file.
Is it safe to scan a virus here?
Yes. Nothing in the archive is ever run. Files are unpacked in the browser's memory and read as data: the rules compare byte patterns, and macros are decoded as text and searched. Nothing is saved to your disk, and nothing is opened by Windows, Office or another program. The scanning code runs as WebAssembly inside a browser worker without access to your files, so even a file crafted to attack the scanner could at worst crash the tab. The danger starts when you extract the files and open them, which is what the scan warns you about first.
What it cannot catch
Each result lists exactly what was checked and what was not. In general:
- New or custom malware. Rules describe malware that is already known. Something written last week for one target may have no rule yet.
- Behaviour. Files are never run, so there is no sandbox that watches what a program does. A program that only turns malicious when it runs, with nothing recognisable in its code, can pass.
- Known-file database. There is no offline list of known malware fingerprints; the VirusTotal links fill that gap when you click them.
- Skipped files. Images, audio, video, fonts and files over 64 MB are not scanned by the rules, and very large archives scan programs and documents first and only some plain text files. Encrypted files need the password.
A clean result means nothing known was found and the archive is built normally, not that every file is safe. Keep your antivirus running when you extract, and do not enable macros in documents from people you do not know.