How to Download Free Software Safely and Avoid Malware

Free software is useful, but fake downloads are one of the easiest ways for malware to reach your computer. Malware can steal passwords, show endless ads, lock your files or quietly use your internet. The good news: a few simple habits prevent most problems.

India’s national cyber security agency, CERT-In, gives the same basic advice in its Cyber Security Do’s and Don’ts: download software only from trusted, official sources, and do not use pirated or unauthorised software.

Step 1: Find the real official website

Search for the program’s name and look for the maker’s own website, not a “download portal”.
Be careful with the top search results. Some are paid ads marked “Sponsored” or “Ad”. Criminals buy these ads to show fake sites.
Read the web address in the address bar letter by letter. Fake sites use tiny spelling changes or extra words, such as “-download” or “-free” added to the real name.
If you are unsure, open the program’s Wikipedia page. It usually lists the official website.
On a phone, install apps from the Google Play Store or Apple App Store. Do not install APK files sent on WhatsApp, SMS or email.

This is not only a theory. In February 2026, CERT-In’s Cyber Swachhta Kendra warned about malware disguised as the popular Notepad++ installer. It was spread through deceptive download sites, advertisements and cracked-software portals. Its advice was to be careful when clicking links during a web search.

Step 2: Avoid fake download buttons

Download pages often show several big green “Download” buttons. Many are ads.
The real link usually names the program and version, for example “Download GIMP 3.2” or “Windows Installer”.
Hover your mouse over a button. Your browser shows the link address in the bottom corner. If it points to a different website, do not click.
If a page says your computer is infected and asks you to download a “cleaner”, close the tab. Real websites do not scan your computer.
If a download starts that you did not ask for, cancel it and delete the file.

Step 3: Watch out for bundled adware

Some installers try to add extra programs: browser toolbars, “PC optimisers”, or a new search engine. This is called bundled software or adware.

Read every installer screen. Do not just keep pressing “Next”.
If you see “Custom” or “Advanced” install, choose it. It shows hidden offers.
Untick any box that installs something you did not ask for.
Click “Decline” or “Skip” for offers. Declining does not stop the main program from installing.
After installing, open your browser settings and check the home page and search engine have not changed.

Step 4: Check the file before you open it

File type: Windows programs usually end in .exe or .msi. A “PDF” or “song” that ends in .exe is a trap. Turn on File name extensions in File Explorer’s View menu to see this.
File size: a full office suite is hundreds of MB. A 2 MB “installer” for it is suspicious, unless the official site says it is a small online installer.
Publisher: right-click the file, choose Properties, and open the Digital Signatures tab if it is there. The signer should be the real maker. When you run it, the Windows permission box should show a “Verified publisher”. “Unknown publisher” is a warning sign for well-known software.
Scan it: right-click the file and choose “Scan with Microsoft Defender”. On Windows 11 you may need to click “Show more options” first.
Second opinion: you can upload a file to VirusTotal to check it with many antivirus engines. Some projects, such as GIMP, publish a checksum and a VirusTotal link on their download page so you can compare.

Step 5: Keep Windows protection switched on

Windows Security / Microsoft Defender Antivirus is built into Windows 10 and 11. Open it from the Start menu and keep real-time protection on.
If you think something is wrong, open Windows Security, go to Virus & threat protection and run a Quick scan.
Microsoft Defender SmartScreen checks downloads against a list of reported harmful programs. It also warns when a file is not commonly downloaded. Do not click “Run anyway” unless you are sure the file came from the official site.
Install Windows updates and program updates promptly. CERT-In lists this as a basic habit, because old software is a common target.
Use one antivirus. Two running together can slow the computer and clash.

If you think you installed malware

Disconnect from the internet (turn off Wi-Fi or unplug the cable).
Open Settings > Apps and uninstall anything you did not mean to install.
Run a full scan in Windows Security.
From a different, clean device, change passwords for email, banking and UPI apps.
If money was taken or you see fraud, call the national cyber crime helpline 1930 and report at cybercrime.gov.in. Cyber security incidents can also be reported to CERT-In at [email protected] or toll-free 1800-11-4949.

Common mistakes

Downloading “cracked”, “patched” or “activator” versions of paid software.
Trusting the first search result without reading the web address.
Clicking the biggest “Download” button on a page full of ads.
Pressing “Next” on every installer screen without reading.
Turning off antivirus because a website or video told you to.
Clicking “Run anyway” on a SmartScreen warning for a file from an unknown site.
Installing APK files from WhatsApp, Telegram or SMS links.
Following instructions on a fake “CAPTCHA” page that asks you to paste or run commands on your computer.

Official links

Last checked: November 2026