Scan Downloads

Scan Downloads watches your download folders and runs Defender plus Stealth Antivirus on each new file.

What is Scan Downloads?

Scan Downloads automatically passes every newly downloaded file through two independent engines at once: Windows Defender's on-demand scanner and the in-app Stealth Antivirus engine. Both verdicts are combined, so if either engine flags the file it is treated as a threat and quarantined before you can open it.

How it works

Stealth monitors your standard download folders (Downloads, Desktop, and your default browser save paths) using a low-overhead file watcher. When a new file appears, Stealth fans the scan out in parallel:

  • Windows Defender runs a Start-MpScan / MpCmdRun custom scan against the file using your latest Microsoft virus definitions.
  • Stealth Antivirus runs a SHA-256 intel lookup, YARA-X pattern match, and a deep signature pass using the bundled Stealth definitions.

The notification shows a chip for each engine with its individual verdict. If Stealth AV finds a threat, the file is moved into the encrypted Stealth quarantine vault automatically; if Defender finds it first, Defender handles the quarantine.

What gets scanned

  • Files downloaded by any browser (Chrome, Edge, Firefox, Brave, etc.)
  • Files saved through StealthChat, StealthTransfer, and other Stealth tools
  • Files extracted from archives into watched folders
  • Files moved or copied into the Downloads folder by other applications

Privacy & Performance

  • Both scans run entirely on your local machine - no file data leaves your device
  • Defender + Stealth AV run in parallel so total scan time stays under a second for most files
  • Uses Defender's existing definitions plus the bundled Stealth intel, YARA-X, and deep-signature definitions - no extra signature downloads required
  • Clean files are cached by hash so repeat downloads skip straight to the result

When to disable

Leave this on for everyday use. You may want to temporarily disable it if you are intentionally working with security research samples, large legitimate archives that trigger heuristic false positives, or files inside an isolated development sandbox.