How to Protect Your Browser When Downloading Files

Most malware arrives as a download you chose to open: a fake installer, a disguised document, or a "required update". Chrome blocks many dangerous files, but your habits catch the rest.

Get files from the right place

• Download software from the developer's official site or an official app store.
• Be wary of search ads for downloads; scammers buy ads for popular free software. See how to tell ads from real results.
• Avoid "free" versions of paid software. They're one of the most common ways malware spreads.

Turn on Chrome's protection

Go to Settings → Privacy and security → Security and choose Enhanced protection. Chrome then checks downloads against Google's latest threat data and can scan suspicious files more deeply. Take its warnings seriously: "dangerous" means known malware, and "uncommon" means few people have downloaded it, which is a reason to be careful.

Spot disguised files

• Show file extensions. In Windows File Explorer, choose View → Show → File name extensions. A file named invoice.pdf.exe is a program, not a PDF.
• Be suspicious of program files (.exe, .msi, .scr, .bat, .js) you didn't expect, and of password-protected ZIP files from strangers, which hide their contents from scanners.
• Don't enable macros in Office documents from emails or downloads.

Scan before you open

Your antivirus, such as Windows Security, scans downloads automatically. For a second opinion, upload the file to VirusTotal, which checks it with many antivirus engines. Don't upload private documents there, since uploaded files can be shared with security researchers.

Two scams to know

• Fake updates: websites that say your browser is out of date and offer a download. Chrome updates itself; check under Settings → About Chrome instead.
• "Paste this to verify": pages that ask you to press keys and paste a command into your computer to prove you're human or fix an error. The command installs malware. Never do it.

Protect what you copy

Sites can also ask to read your clipboard, which may hold passwords, codes or account numbers you just copied. Clipboard Guard asks before any site reads your clipboard and keeps a log of attempts. It doesn't stop sites putting text into your clipboard, which is why the paste-a-command rule above matters.

Useful Chrome settings

• Ask where to save each file (Settings → Downloads) so nothing downloads silently.
• Block automatic downloads from sites that try to start several at once (Site settings → Automatic downloads).

For more, see how to secure your browser for banking.