Like Vaskez said, you can tell your virus scanner to scan that particular file, even if it's still zipped or in an exe. Of course, part of the issue is knowing where you're downloading from to begin with...
From the URL perspective, one thing you can check for is what the actual URL is. Look for any extra HTTPs in the middle; they can signify that someone is trying to hide the real URL so you won't notice it. For example:
http://www.microsoft.com@http://www.gotyousucker.com
looks like Microsoft, but it's really gotyousucker.
If there are extra https, make sure you're comfortable with the real one.