Archive Safety: How to Open ZIP, RAR and 7z Files Without Getting Malware
An archive cannot harm you while it sits in your Downloads folder. The danger comes from what is inside it and what you do next. Criminals use ZIP, RAR, 7z and ISO files because they hide the real file type, slip past email filters and make dangerous files look ordinary. This guide explains the tricks and gives a checklist you can actually follow.
Updated 2026-10-13 · Written and tested by the UnpackNest editorial team (TECCONET)
Why archives are used to deliver malware
- Disguise. A file inside an archive is not visible until you open it, so the email only shows
invoice.zip, not the program inside. - Filter evasion. Encrypted archives cannot be scanned by email gateways. The password is put in the email text.
- Warning evasion. Windows marks downloaded files with a "Mark of the Web" that triggers SmartScreen and Office's Protected View. Some extraction tools did not pass that mark on to extracted files, and disc images (ISO, IMG) used to drop it entirely until Microsoft fixed this in 2022.
- Bugs in extractors. Old or unpatched archive programs have had security vulnerabilities. A WinRAR flaw fixed in 2023 (CVE-2023-38831) let crafted archives run code when a user opened what looked like a harmless file.
Warning signs in the email or message
- You did not expect the file, or the sender is unknown.
- Urgency: unpaid invoice, failed delivery, legal notice, password reset.
- The password is in the same email as the archive.
- The archive is tiny but claims to contain a big document set.
- A colleague's account suddenly sends an archive with a vague message ("see attached").
Warning signs inside the archive
| You see | Why it is suspicious |
|---|---|
invoice.pdf.exe, photo.jpg.scr | Double extension: the last part is the real type. Windows hides known extensions by default |
.exe, .scr, .com, .bat, .cmd, .ps1, .vbs, .js, .hta, .msi | Programs and scripts that run when double-clicked |
.lnk shortcuts | Shortcuts can run commands while looking like a document |
.docm, .xlsm | Office files with macros |
| An ISO or IMG inside a ZIP | Layered containers designed to hide the payload |
| A single file with lots of spaces before the extension | Pushes .exe out of view in narrow columns |
In Windows, turn on File name extensions (File Explorer > View > Show) so the real types are visible.
What a careful extraction tool blocks
Some dangers are in the archive's structure rather than the files. These are the checks UnpackNest's tools apply, and what you should expect from any good extractor:
- Path traversal ("Zip Slip"). Entries named like
../../Startup/evil.exetry to write outside the folder you chose. UnpackNest blocks them. - Absolute paths and links. Entries pointing to
C:\Windows\…or symbolic links can overwrite or expose files. UnpackNest shows them but does not write them. - Decompression bombs. A few kilobytes that expand to petabytes can freeze or fill a device. UnpackNest's ZIP and TAR/GZ tools refuse entries with extreme compression ratios and enforce size limits.
A checklist before you open any archive
- Was it expected? If not, confirm with the sender by another channel, not by replying to the email.
- Look before extracting. List the contents first (the UnpackNest tools always do this). If you see programs or shortcuts you did not expect, stop.
- Extract only what you need. You can extract a single PDF and leave the rest.
- Keep the warning. Use tools that preserve Windows's Mark of the Web; File Explorer does, and 7-Zip can (under Tools > Options > 7-Zip > Propagate Zone.Id stream). Browser downloads from UnpackNest are new downloads, so your browser marks them as downloaded files.
- Scan if unsure. Microsoft Defender scans on access. You can also right-click a file and choose Scan with Microsoft Defender.
- Keep software updated. Update your extraction tool, browser and operating system. Old extractors are a real risk.
- Never "enable content" in a document from an archive you did not expect. That button runs macros.
About online scanners
Services such as VirusTotal check a file against dozens of antivirus engines. They are useful for suspicious programs, but uploading shares the file with the service and, often, with security researchers. Never upload private documents, contracts or personal photos to a public scanner. For those, scan locally.
For businesses
- Block executable attachments and encrypted archives from external senders at the mail gateway, or quarantine them for review.
- Configure Windows to always show file extensions.
- Teach staff that a password in the same email is a red flag, not a security feature.
Frequently asked questions
Can just opening a ZIP infect my computer?
Listing a ZIP in an up-to-date tool is generally safe. Infection normally requires running something inside. Rare exceptions are bugs in old extractors, which is why updates matter.
Are RAR files more dangerous than ZIP?
No. The danger is the content, not the format. RAR and 7z are slightly more popular with criminals because some filters handle them less well.
Does extracting in the browser protect me from malware?
It protects against structural tricks (unsafe paths, links, bombs) and keeps the archive off servers. A malicious program you extract and then run is still dangerous.
Tools for this task
- Open and extract ZIP files in your browserStore, Deflate and ZIP64, read on your device.
- Open and extract RAR files in your browserRAR4 and RAR5, read on your device.
- Open 7z files and split .7z.001 archives onlineLZMA/LZMA2, AES-256, multi-volume.