No matter how careful you are online, malware can still find its way onto your Windows PC. Clicking an unsafe link, downloading software from an untrusted website, opening a suspicious email attachment, or connecting an infected USB drive can expose your computer to harmful programs. Malware can slow down your system, steal personal information, damage files, and even give cybercriminals remote access to your PC.
Windows 11 and Windows 10 include powerful built-in security tools that make scanning for malware simple. Whether you want to perform a quick check or a complete system scan, Microsoft Defender Antivirus can help detect and remove threats before they cause serious damage.
In this guide, you’ll learn exactly how to scan your device for malware in Windows 11 and Windows 10.
Scan Your Device for Malware in Windows 11/10
If you have noticed that your computer is running unusually slow, showing unexpected pop-ups, opening unfamiliar programs, or behaving differently than normal, it is a good idea to run a malware scan immediately. Fortunately, Windows makes the entire process straightforward.
The steps below walk you through the complete malware scanning process. Follow each step for the best results.
Step 1: Open Windows Security
The first step is to launch Windows Security, which is Microsoft’s built-in security application. This tool protects your computer against viruses, malware, spyware, ransomware, and other security threats without requiring additional antivirus software.
To begin, click the Start button and type Windows Security into the search box. When the application appears in the search results, click it to open. You can also access it by opening Settings, selecting Privacy & Security in Windows 11 or Update & Security in Windows 10, and then choosing Windows Security.
Once the application opens, you’ll see several security categories, including Virus & threat protection, Firewall & network protection, App & browser control, and Device security. Since you’re checking for malware, you’ll primarily work inside Virus & threat protection.
Before moving to the next step, make sure Microsoft Defender Antivirus is active. If another antivirus program is installed, it may temporarily manage your system protection instead.
Step 2: Open Virus & Threat Protection
Inside Windows Security, click Virus & threat protection. This section displays your current protection status, recent scans, and any active threats that require attention.
You’ll also find information about your antivirus updates, security history, and scanning options. Take a moment to verify that your Security Intelligence is current. Updated malware definitions help Windows recognize the latest threats.
If Windows notifies you that updates are available, click Protection updates, then choose Check for updates. Installing the latest security definitions before scanning greatly improves the chances of detecting newly discovered malware.
Once everything is updated, you’re ready to select the scan that best fits your situation.
Step 3: Choose the Right Scan Type
Click Scan options to view the different scanning methods available in Microsoft Defender Antivirus.
The Quick Scan checks commonly targeted locations, including running processes, startup folders, and system memory. It usually finishes within a few minutes and is perfect for routine security checks.
The Full Scan examines every accessible file, folder, installed program, and connected drive. Because it scans your entire computer, it may take anywhere from thirty minutes to several hours depending on your storage size and the number of files.
The Custom Scan allows you to select a specific folder, external drive, or location that you believe may contain malware. This option is useful after downloading files from the internet or copying data from a USB drive.
The Microsoft Defender Offline Scan restarts your computer and scans your system before Windows fully loads. This is especially effective for detecting rootkits and advanced malware that may hide while Windows is running.
Choose the scan type that matches your situation before continuing.
Step 4: Start the Malware Scan
After selecting your preferred scan type, click Scan now.
The antivirus engine immediately begins examining your computer for suspicious files, malicious software, harmful scripts, and potentially unwanted applications.
During the scan, you’ll see the progress displayed on screen along with the number of files already checked. Although you can continue using your PC during a Quick Scan, it is generally better to avoid opening unnecessary applications during a Full Scan. This helps Windows dedicate more resources to the scanning process and may improve overall performance.
Avoid interrupting the scan unless necessary. Stopping it midway could leave parts of your system unchecked.
Review the Scan Results
When the scan finishes, Windows displays the results on the screen.
If no threats are detected, you’ll receive a message confirming that your device is secure. This means Microsoft Defender did not find any known malware based on the latest security definitions.
If suspicious files are found, Windows lists each detected threat along with its risk level and recommended action. Common recommendations include Quarantine, Remove, or Allow.
Most users should choose Quarantine or Remove. Quarantining isolates the infected file so it cannot harm your computer while still allowing recovery if it turns out to be a false positive.
Take a few moments to carefully review the scan report before proceeding.
Remove or Quarantine Detected Threats
If malware is detected, follow the recommendations provided by Microsoft Defender Antivirus.
Click Start actions to allow Windows to automatically quarantine or remove malicious files. In many cases, the removal process is completed immediately without requiring any additional work.
Some infections affect files that are currently being used by Windows. In these situations, Microsoft Defender may request a system restart to finish removing the malware.
Allow the restart if prompted. Completing the cleanup process ensures that the malicious software is fully removed before it has another chance to run.
Run a Microsoft Defender Offline Scan for Persistent Threats
If your computer continues showing signs of infection after a standard scan, run a Microsoft Defender Offline Scan.
Return to Scan options, choose Microsoft Defender Offline Scan, and click Scan now.
Your computer will restart automatically and perform the malware scan outside the normal Windows environment. Since advanced malware often hides while Windows is running, scanning before the operating system loads gives Defender a much better opportunity to detect and remove deeply embedded threats.
The process typically takes around fifteen minutes, after which Windows automatically starts normally.
Check Protection History
After completing the malware scan, open Protection History inside Windows Security.
This section provides a detailed record of detected threats, quarantined files, completed scans, and actions taken by Microsoft Defender.
Reviewing this information helps you understand exactly what was found and whether additional action is required. If multiple threats continue appearing repeatedly, it may indicate that another infected file or application is reinstalling the malware.
Checking the protection history also helps confirm that the cleanup process completed successfully.
What to Do After Detection of Malware?
Finding malware on your computer can be alarming, but acting quickly can prevent further damage. Start by allowing Microsoft Defender Antivirus to quarantine or remove every detected threat. Do not ignore security warnings or continue using infected files.
After the malware has been removed, restart your computer if Windows requests it. Once your PC starts again, install the latest Windows Updates and make sure your antivirus definitions are fully updated. New updates often include important security patches that prevent similar infections.
Next, scan any external USB drives, portable hard drives, or memory cards that were recently connected to your computer. Malware frequently spreads through removable storage devices, so checking them helps prevent reinfection.
If you downloaded software shortly before the infection was detected, uninstall the suspicious application unless you are completely certain it is safe. Likewise, remove any unfamiliar browser extensions that appeared without your permission.
Change the passwords for your important accounts, especially your Microsoft Account, email, banking, shopping, and social media accounts. If malware attempted to steal your credentials, updating your passwords immediately reduces the risk of unauthorized access.
Monitor your accounts over the next several days for unusual activity. If you notice unfamiliar logins or transactions, take immediate action by changing passwords again and enabling Two-Factor Authentication wherever available.
Finally, create regular backups of your important files using OneDrive, an external drive, or another trusted backup solution. Having a recent backup ensures you can recover your data even if ransomware or another serious malware infection occurs in the future.
FAQs
Does Windows 11 have built-in malware protection?
Yes. Windows 11 includes Microsoft Defender Antivirus, which provides real-time protection against viruses, malware, spyware, ransomware, and many other security threats.
Is Microsoft Defender good enough?
For most home users, Microsoft Defender Antivirus provides excellent protection when combined with safe browsing habits, regular updates, and routine malware scans.
How often should I scan my Windows PC?
Running a Quick Scan once every week and a Full Scan at least once every month is a good practice. You should also perform a scan immediately after downloading files from unknown sources or noticing unusual system behavior.
What is the difference between a Quick Scan and a Full Scan?
A Quick Scan checks the most common areas where malware hides and finishes quickly. A Full Scan examines your entire computer, including all files, folders, applications, and connected storage devices.
What is Microsoft Defender Offline Scan?
A Microsoft Defender Offline Scan restarts your computer and scans it before Windows fully loads. This method is especially effective against advanced malware and rootkits that can hide during normal operation.
Can malware hide from a normal scan?
Yes. Some advanced malware can conceal itself while Windows is running. In these situations, an Offline Scan provides a better chance of detecting and removing the infection.
Should I delete quarantined files?
In most cases, quarantined files should remain isolated unless you are certain they are false positives. Windows safely stores them where they cannot damage your computer.
Can I use another antivirus with Microsoft Defender?
Yes. Installing another antivirus may automatically place Microsoft Defender Antivirus into passive mode. Many users choose one primary antivirus program to avoid software conflicts.
Summary
Scanning your computer for malware in Windows 11 and Windows 10 is one of the easiest and most effective ways to keep your system secure. With Microsoft Defender Antivirus, you can perform Quick Scans, Full Scans, Custom Scans, and Offline Scans without installing additional software.
By keeping your security definitions updated, selecting the appropriate scan type, reviewing scan results carefully, removing detected threats, and following up with system updates and password changes when necessary, you can significantly reduce the risk of future infections.
Making malware scans a regular part of your PC maintenance routine helps ensure your Windows device remains fast, stable, and protected against today’s evolving cyber threats.