JL3 VirusTotal: Scan a File or Link and Read the Result

VirusTotal is a web checking service that runs a file or a web address past many antivirus engines at once. If someone sends you an install file that claims to be a casino lobby, or a short link that is supposed to open one, VirusTotal is the quickest second opinion you can get before anything touches your phone. The better habit is still to need no file at all, which is what the mobile browser play explained explains; this page is for the moment you are unsure.

How VirusTotal checks a file or a link

VirusTotal’s own documentation says it inspects items with more than 70 antivirus scanners and URL or domain blocklisting services. You can submit files and addresses through its web page, browser extensions or its programming interface.

Before you start

1. Use a computer or your browser, not the file itself: you are uploading it, never opening it.
2. Never upload private documents. VirusTotal’s documentation says submissions are shared with its security partners and that an uploaded file cannot generally be deleted on request.
3. Have the file or link ready, ideally still unopened in your downloads or the chat it came in.

Step by step: run the check

1. Open VirusTotal in your browser. Its page offers File, URL and Search.
2. Choose File or URL. Upload the file you were sent, or paste the link.
3. Wait for the engines to finish. The report fills in engine by engine.
4. Read the detection count and the names. See how many engines flagged it and what they called it.
5. Decide. Delete the file or skip the link if several engines flag it.

How to read a VirusTotal result

VirusTotal is careful about its words, and so should you be. Its documentation says a green tick means that engine did not detect the file, and that it avoids the word “clean” because an antivirus engine only flags what it recognises as malicious. Its documentation also says the engines it runs can be tuned differently from the retail versions you buy, so a verdict on VirusTotal can differ from the same product on your own computer.

False positives and disputes

VirusTotal’s documentation says it gathers other companies’ verdicts and cannot remove a detection itself: you re-analyse the file, and a developer who thinks a verdict is wrong takes it up with that antivirus vendor. For a player, that comes down to three rules:

1. A site telling you to ignore VirusTotal’s warnings because they are “false” is asking you to take its word over many engines.
2. Re-running the scan later is fine; engines update, and a new result can differ.
3. Only the antivirus vendor can withdraw its own verdict, never the site that sent you the file.

What happens after a check