Introduction
The anti-malware scanner, a feature of Scam, phishing, and malware protection (formerly Threat Protection Pro™), scans your downloads for malicious software. It automatically blocks viruses, ransomware, and other threats before they can infect your device.
How does the anti-malware scanner work?
- Real-time scanning – Instantly scans downloaded files and alerts you to any potential threats, letting you choose whether to delete or keep the file.
- Always-on protection – Guards your device 24/7, working continuously in the background even when you are not connected to a VPN server.
- Lightweight performance – Integrated directly into the NordVPN app, it protects your system with a minimal impact on your device's speed and performance.
- Advanced prevention – Uses a combination of signature-based detection, machine learning, and an optional cloud-based scanner to identify even the newest cyber threats.
File quarantine
When the Anti-malware scanner detects a malicious file, what happens next depends on your Auto-delete malicious files setting in Scam, phishing, and malware protection:
- If Auto-delete malicious files is on, the malicious file is removed automatically. You will see a system notification confirming the deletion, and the file appears in your scan history marked as Deleted. (The in-app "Malicious file detected" notification is suppressed when auto-delete is on.)
- If Auto-delete malicious files is off, the malicious file is moved to "quarantine" instead of being deleted. Quarantined files are isolated and cannot harm your device, but they are kept until you decide what to do with them. You will receive an in-app and system notification, and the file is added to your scan history with a "Quarantined" status.
NOTE: This feature is not yet released for macOS.
How to delete or keep a file from the quarantine:
- Click the notification, or click the quarantined file in the scan history list.
- In the pop-up that opens, choose "Delete file" to remove the file permanently or "Keep file" to restore it to its original location.
How quarantined files appear in the app
- Quarantined files always appear at the top of the scan history list, sorted by date (oldest first), regardless of when newer deleted or kept entries were added.
- A red badge appears over the Scam, phishing, and malware protection icon in the side navigation bar whenever at least one file is in quarantine.
- A "File in quarantine" / "Files in quarantine" indicator appears on:
- The Scam, phishing, and malware protection widget on the dashboard.
- The Anti-malware block in the Advanced settings screen.
- The Malware scanner screen itself, whether the feature is currently on or off.
NOTE: The scan history holds a maximum of 100 entries. Quarantined files take priority over older scanned entries:
- If your history is full and a new file is quarantined, the oldest non-quarantined entry is removed to make space.
- If 100 or more entries are already quarantined, new quarantined files are not added to the visible list until you clear some by deleting or keeping them.
Using Delete protection history removes deleted and kept entries, but does not remove the files themselves. Quarantined files remain visible until you decide to delete or keep them.
Edge cases
- If a quarantined file is moved, renamed, or corrupted outside of the NordVPN app, its status changes to "Failed to delete malware," and the app can no longer do anything with it.
About the Malware scanner toggles
The Malware scanner view contains three toggles: Malware scanner, Cloud-based threat scanner, and Auto-delete malicious files. Keep the following in mind:
- Toggles represent your preference, not the real-time status of the feature. When Scam, phishing, and malware protection are turned on, it enables all sub-features whose toggle is set to the on position; sub-features with toggles in the off position remain unchanged.
- Toggle states are persisted locally on your device and are preserved between app sessions. For first-time users, all toggles are set to on by default.
- The Cloud-based threat scanner and Auto-delete malicious files toggles are disabled when the Malware scanner toggle is off. Turn the Malware scanner on first to configure these options.
- The default state for the Cloud-based threat scanner is off, to respect user privacy.
- The default state for Auto-delete malicious files is off, to prevent accidental permanent file loss.
Requirements
Make sure that you have the NordVPN Plus or Ultimate subscription active and that the NordVPN application is installed on your macOS or Windows device.
Here's what to do
- Open the NordVPN app.
- Click the shield icon on the left side of the NordVPN application to open Scam, phishing, and malware protection.
- Click the Advanced settings card (titled "Protection preferences") in the bottom-right of the main view.
- In the Anti-malware block, click the Malware scanner row to open the Malware scanner inner view.
- Turn on the Malware scanner toggle. Optionally, also enable Cloud-based threat scanner and/or Auto-delete malicious files according to your preference:
Additional tips
- Always download files and software from official websites and trusted sources.
- Be cautious with email attachments, especially from unknown senders.
- Keep your operating system and all applications up to date to patch security vulnerabilities.
