Check files before opening
Before you open files from a ZIP or RAR
An archive is a container, not a recommendation to open everything inside. Check its source first, then use Windows to review and scan the files you actually received.
Already suspicious? Do not extract it just to investigate. Keep it unopened and verify the sender, or ask your IT or security team to inspect it through their own process. Neither a successful extraction nor a scan with no detections guarantees safety.
Check that you expected this archive
Before extracting, confirm who sent the ZIP or RAR and what should be inside. For an unexpected attachment, contact the sender through a channel you already trust. Do not rely on a phone number, link or reply address supplied only by the suspicious message. If the source cannot be verified, leave the archive unopened.
Make the full filenames visible
In Windows 11 File Explorer, choose View, Show, then File name extensions. Read the ending of each filename rather than trusting its icon. For example, invoice.pdf.exe is an executable ending in .exe, not a PDF. Do not rename it to make it look like the document you expected.
Scan the archive before extracting
Right-click the downloaded archive, choose Show more options, then Scan with Microsoft Defender. Wait for the result. If a different antivirus is your active security provider, use its file-scanning command instead. A warning or detection is a reason to stop and review, not to switch protection off.
Extract trusted material into a separate folder
Only proceed when you have a reason to trust the source. Choose a new, separate destination so that incoming files are easy to distinguish from your own work. Extract the archive without launching its contents. The separate folder helps you organize the review; it is not a sandbox or a security boundary.
Scan the result, then compare it with what you expected
Scan the extracted folder using your active antivirus. Review the filenames and file types without opening the files. If a photo delivery contains a program, a script or instructions to disable security, stop and check with the sender. Open only the files you intended to receive, and do not dismiss a security warning just because extraction succeeded.
Read the file type, not just the name
A delivery called photos.zip might contain photographs, but its outer name does not tell you what every item inside will do. If you were expecting JPG images, pause at an unexpected .exe program or .bat script. A .docm file is a macro-enabled Word document, which is different from an ordinary .docx document. These endings are reasons to ask whether the file belongs in this delivery, not a complete list of dangerous or harmless formats.
Microsoft explains how to show filename extensions and what common extensions mean. Changing the ending does not convert the file. If the sender intended to send a PDF, ask for the right document rather than trying to turn an unexpected program into one.
If the scan command is missing
Windows 11 may put the command under Show more options. If it is still absent, open Windows Security, go to Virus & threat protection, and check Manage providers to see which security product is active. Use that product's supported scan workflow. Microsoft's file and folder scanning instructions explain both the Defender command and the case where another antivirus is installed.
For a work-managed computer, a missing option may need your IT team's help. Do not add an exclusion, disable protection or install a second security product just to get an archive open. If a scan finds a threat, leave the affected files alone and follow the security product's guidance.
A warning needs context
SmartScreen can warn about an application with an unknown reputation as well as one with a negative reputation. A warning is not, by itself, proof of malware, but it is not something this extraction guide can clear for you. Check the publisher, the download source and why you need to run that file. Microsoft describes these reputation checks.
The absence of a warning is not a certificate of safety either. Do not assume every extraction tool preserves the same Windows warning behavior. This guide does not claim that EasyUnZip transfers download-origin warnings to extracted files.
Where EasyUnZip fits
Once you have chosen to extract trusted material, EasyUnZip can handle ZIP and RAR files and put their contents in a destination you choose. Use a separate review folder before moving files into a working project. The guide to avoiding overwrites covers that organization step in detail.
Extraction, filename review and malware scanning are separate jobs. EasyUnZip does not provide antivirus scanning, and extracting only selected file types is not a substitute for it. For the source check at the start of this workflow, Microsoft's attachment guidance also recommends checking the sender and whether the file types are what you expected.
Reviewed on 4 November 2026 against the Microsoft documentation linked above and EasyUnZip 0.2.0's source. The Windows 11 menus and installed app were not tested during this review. Scan time depends on the files and security product.
Common questions
Does a scan with no detected threats prove a ZIP is safe?
No. Treat scanning as one check alongside the source, expected contents and Windows warnings. A clean scan does not give an unknown sender or an unexpected program a reason to be trusted. Leave a file unopened if something does not fit.
Is a password-protected archive more trustworthy?
A password controls access to the archive; it does not establish who created the files or whether they are safe. Verify the sender and purpose first. If you choose to extract a trusted encrypted archive, scan the resulting files too.
Can EasyUnZip check files for viruses?
No. EasyUnZip extracts ZIP and RAR files on Windows. Use Windows Security or your active antivirus for malware scanning. Its extraction result and file-type filter are not a safety verdict, and choosing only a document extension does not guarantee that those documents are harmless.
Should I unblock a file to make a warning disappear?
Do not use unblocking, Run anyway, enabling macros or turning protection off as routine extraction steps. Check why the warning appeared and verify the file's source. On a work computer, follow your organization's security process instead of bypassing its controls.