Search results for a well-known archiver are still crowded with pages that offer a "personal edition" nobody authorised. The installer is often the real program wrapped in an ad bundle, sometimes with a browser extension that survives uninstall.
Five checks
- **Domain, not design.** A convincing layout costs nothing. Compare the domain letter by letter against the address you already trust.
- **File name and size.** Official builds have stable names. A file named setup_final_new.exe is a warning.
- **Signature.** Right-click the installer, open Properties, Digital Signatures. An unsigned installer from a vendor that always signs is suspect.
- **Download path.** Direct file links are normal. Redirects through three ad networks are not.
- **Payment page.** If a free extraction tool asks for a card number before download, close the tab.
After installing
Run a full scan, then check which browser extensions were added in the last ten minutes. Remove anything you did not choose deliberately. If the app installed without asking where to put it, look in the Programs list for extra entries.
For IT teams
Block the lookalike domains at DNS, distribute the installer from your own software repository, and keep the hash of the approved build next to the deployment script. When a user reports a strange download page, you can compare hashes in seconds.