How to Scan for Viruses with Windows Security (Microsoft Defender)

Follow these steps in order to run a virus scan using the antivirus already built into Windows.

  1. Open the Windows Security app

    Search for "Windows Security" in the Start menu and open it, then click "Virus & threat protection."

  2. Run a quick scan for routine checks

    A "quick scan" checks only the download folder and key system locations where malware is most commonly found, usually finishing in 5 to 15 minutes. For everyday use, a quick scan is generally all you need.

  3. Run a full scan to check the entire computer

    Choosing "full scan" under scan options checks every file on your hard drive along with all running programs. Depending on your computer's performance, this can take an hour or longer.

  4. Scan only a specific folder with a custom scan

    If you want to check only a suspicious folder or a USB drive rather than the whole system, choose "custom scan" and specify exactly which location to check.

  5. Use Microsoft Defender Offline for stubborn malware

    If you suspect malware that a normal scan cannot remove, run "Microsoft Defender Offline." Your computer restarts and the scan runs before Windows fully loads, so it is not disrupted by anything the malware might do while Windows is running.

  6. Set up a recurring scan schedule

    In the Task Scheduler app, find the entry for Windows Defender Scheduled Scan and set your preferred frequency and time to run automatic scans on a regular basis.

  7. Review anything sent to quarantine

    Under "Virus & threat protection," check "Protection history" to see items that were found and quarantined during a scan, and restore or permanently delete them as needed.

Quick scan is enough most of the time β€” but not always

A quick scan is well suited for routine, everyday checks because it targets the locations malware most commonly hides. But if you have gone a long time without scanning, downloaded something from an unfamiliar source, or are seeing symptoms like unusual pop-ups or a suddenly sluggish computer, it is worth running a full scan β€” or an offline scan if a full scan does not resolve it β€” rather than relying on a quick scan alone.

What an offline scan does differently

A normal scan runs while Windows itself is fully loaded and running, which means any malware sophisticated enough to hide from a running operating system, such as certain rootkits, can potentially evade detection. An offline scan restarts the computer into a minimal pre-Windows environment before the operating system β€” and whatever the malware might be doing to hide within it β€” is running, letting the scan examine the system from a position the malware cannot manipulate.

Frequently Asked Questions

Is a quick scan enough on its own?

A quick scan is fine for routine use, but if you have not scanned in a long time or suspect an infection, it is safer to also run a full scan or an offline scan.

Can I keep using my computer while it scans?

Quick scan, full scan, and custom scan all run in the background, so you can keep using your computer normally. Offline scan requires a restart, though, so the computer is unavailable for normal use while that scan runs.