Yes, MSI files can contain malware. An .msi file is a Windows Installer package, not a harmless document: when you run it, Windows Installer can copy programs, change settings, create services, and execute custom actions. Downloading an MSI without running it is usually not the same as installing it, but the package should remain unopened until you verify its source, signer, and contents.
The extension alone cannot tell you whether an installer is safe. A legitimate vendor and a malicious operator can both build an MSI package, and a convincing filename such as Update.msi does not establish who created it.
What can an MSI file do?
MSI is the standard installation database format used by Windows Installer. It can contain application files and instructions for installing, repairing, updating, or removing software. Microsoft also allows package authors to add custom actions that launch executables, call DLL functions, or run VBScript and JScript code.[1]
Those features are useful for legitimate software, but they also mean a hostile package can install a payload, add persistence, or make system changes with the privileges you approve. A User Account Control prompt is therefore a request to authorize installation—not proof that Windows has certified the package as safe.
| What happened | Risk and next step |
| You only downloaded the MSI | Keep it closed. Verify the download source, signer, hash, and scan result before deciding whether to delete or install it. |
| You opened Properties or inspected the package | This normally does not install it. Do not double-click embedded files or approve an installation while inspecting. |
| You launched it but canceled before approving UAC | Risk is lower, but check whether another process or browser download ran first. Delete an untrusted package and scan if the source was suspicious. |
| You completed the installation | Treat the installed program and any added services, tasks, or startup items as potentially active until the source and signer are confirmed. |
How to check an MSI file before installing it
1. Return to the real vendor website
Do not judge the file from the download button or filename. Find the developer’s official site independently, navigate to its download page, and confirm that the product, version, and domain match. Windows updates should come through Settings, the Microsoft Update Catalog, or another documented Microsoft channel—not a pop-up page offering a “critical update” MSI.
An MSI received through an unexpected email, chat message, cracked-software page, fake support page, sponsored clone, or video description deserves a default do not run decision. If the file was downloaded but never opened, follow the narrower downloaded-but-not-opened safety checklist.
2. Check the exact name, size, and version
Compare the file with the vendor’s current download information. Look for altered product names, doubled extensions, unusual version numbers, and claims that do not fit the source. Turn on View > Show > File name extensions in File Explorer so a name such as setup.msi.exe cannot masquerade as an MSI.
3. Verify the digital signature
Right-click the file, select Properties, and look for a Digital Signatures tab. Open the signature details and compare the signer with the software publisher you expected. Advanced users with the Windows SDK can also use signtool verify /pa /v package.msi; Microsoft documents that SignTool checks the signature, certificate trust, and revocation state.[2]
A missing signature is a warning for software that should be professionally distributed, but it does not automatically prove malware. Conversely, a valid signature proves that the file was signed and has not changed since signing; it does not prove that the publisher is trustworthy or that the software’s behavior is desirable.
4. Compare the SHA-256 hash when the vendor publishes one
In PowerShell, run Get-FileHash "C:\Users\YourName\Downloads\package.msi" -Algorithm SHA256. Compare the complete output with a checksum published on the vendor’s official HTTPS page. A match connects your copy to that exact vendor-posted file. A hash copied from the same untrusted download page provides much weaker assurance.
5. Scan the package, but interpret the result carefully
Scan the MSI with your installed security software before running it. For a file that is not private or proprietary, a multi-engine reputation check can add context. Treat detections, file age, signer, submission history, and behavior together. “Zero detections” is not a safety certificate, especially for a newly created package or a loader that fetches another component later.
If different services disagree, use the VirusTotal and sandbox result interpretation guide instead of counting detections alone.
6. Inspect contents without installing
MSI packages are structured databases and may contain cabinet archives. Tools that can open MSI packages as archives let you inspect filenames without starting Windows Installer. Look for unexpected scripts, executables, DLLs, drivers, password tools, remote-access components, or files unrelated to the advertised product.
Inspection is a warning-finding step, not proof of safety. Custom actions may be stored in package tables, content can be compressed, and an installer may download another payload after launch. Do not double-click extracted files. The same principle applies to archives: opening and extracting ZIP/RAR files are different from executing their contents.
7. Stop when signals conflict
Do not “test” an installer on your everyday PC when its domain, signer, version, and scan history tell different stories. Contact the vendor through a known support channel or obtain a fresh installer from the official source. A virtual machine or Windows Sandbox can reduce some risk, but it cannot make an unknown package trustworthy or protect accounts you sign into during testing. For broader installer checks, see how to check whether an executable is safe.
What to do if you already ran a suspicious MSI
- Disconnect the PC from the network if the installer came from a fake update, crack, unexpected message, or imitation vendor site. This can interrupt downloads and outbound sessions while you assess the system.
- Record what you ran. Keep the filename, download URL, time, hash, and any visible product name. Do not reopen the installer to take screenshots.
- Uninstall the visible program only if it is listed and you can identify it. Do not assume that uninstalling removes a separate loader, service, scheduled task, or stolen browser session.
- Run a full security scan. Quarantine confirmed detections, reboot, and scan again if alerts or suspicious processes return.
- Check persistence. Review newly installed apps, Startup apps, Task Scheduler, browser extensions, services, and security exclusions created around the installation time.
- Protect accounts from a clean device if you entered passwords after the installation or the package behaved like an information stealer. Change important passwords, revoke active sessions, and enable multi-factor authentication.
- Escalate when trust cannot be restored. For business devices, contact the administrator. If security tools were disabled, remote access appeared, or privileged accounts were used, preserve evidence and consider a clean Windows reinstall.
An MSI can leave an executable, service, scheduled task, startup entry, browser change, or bundled component after the visible installer closes. A full Gridinsoft Anti-Malware scan can check for those leftovers and persistence points; it cannot recover already stolen passwords or prove that no account data left the machine.
If the process path is wrong, the name imitates a Windows component, or high CPU started after an unknown installer, scan for hidden miners, services, startup entries, and bundled components.
Scan for installer leftoversDo not delete random files from C:\Windows\Installer
Windows keeps cached MSI and MSP packages under C:\Windows\Installer so installed programs can repair, update, or uninstall correctly. An unfamiliar randomized filename in that protected folder is not automatically malicious. Deleting cached packages manually can break future updates and uninstallation.
If a security alert names a file there, confirm which installed product owns it, inspect the signer and hash, and let the security tool quarantine a confirmed threat. Do not clean the entire folder or use a registry cleaner to remove installer records.
FAQ
Can an MSI infect a PC just by being downloaded?
Normally, downloading an MSI only saves the package. Infection usually requires the installer or another exploit-capable program to execute content. Keep an untrusted package closed, scan it, and delete it if you cannot verify the source.
Are signed MSI files always safe?
No. A valid signature helps identify the signer and detect post-signing changes, but a certificate can belong to an untrustworthy publisher or be abused. Check the source, expected publisher, file reputation, and behavior as well.
Can I scan an MSI without installing it?
Yes. Use the context-menu scan from your security software, compute its hash, and inspect the package as an archive without launching Windows Installer. Do not execute extracted files during inspection.
Why does an MSI request administrator permission?
Many legitimate installers need elevated access to write protected folders, register services, or make system-wide changes. The UAC prompt tells you that elevated changes are requested; it does not certify the package.
Is MSI the same as MSIL or the MSI computer brand?
No. In this article, MSI means a Microsoft Windows Installer package with the .msi extension. MSIL refers to .NET intermediate language, while MSI is also a hardware company name.
References
- Microsoft. “Custom Actions.” Windows Installer documentation, Microsoft Learn, updated January 7, 2021; accessed July 27, 2026. learn.microsoft.com/en-us/windows/win32/msi/custom-actions
- Microsoft. “SignTool.” Windows cryptography documentation, Microsoft Learn, updated September 2024; accessed July 27, 2026. learn.microsoft.com/en-us/windows/win32/seccrypto/signtool
- Stefan Dasic. “This fake Windows support website delivers password-stealing malware.” Malwarebytes Labs, April 9, 2026; accessed July 27, 2026. malwarebytes.com/blog/scams/2026/04/this-fake-windows-support-website-delivers-password-stealing-malware
