To scan your PC for malware, open the Windows Security app, choose Virus & threat protection, then pick Quick scan, Full scan, Custom scan or the Microsoft Defender Antivirus offline scan from Scan options. Run a quick scan first, a full scan if something still seems wrong, and the offline scan if you suspect malware that hides while Windows is running. This guide follows Microsoft’s own instructions for Windows 11 and Windows 10, plus the FTC and CISA advice for what to do afterwards. Slowdowns and pop-ups have many causes, so a clean scan does not prove either way that a PC is healthy.
How do you run a scan with Windows Security?
According to Microsoft’s support page, which applies to both Windows 11 and Windows 10 with the same menu names, open the Windows Security app and select Virus & threat protection. The Current threats section shows any threats found, the time of the last scan, how long it took and how many files were checked, plus a list of quarantined and allowed items. Under Scan options you choose a scan:
| Scan type | What it checks | When to use it |
|---|---|---|
| Quick scan | The locations where threats are most likely to be | Short on time, or a first check. If Windows Security recommends another scan type, it tells you when the quick scan ends |
| Full scan | Every file and program on the device | A quick scan found nothing but the PC still behaves oddly |
| Custom scan | Only the files or folders you pick | A single download or external drive |
| Microsoft Defender Antivirus (offline scan) | Runs in the Windows Recovery Environment before Windows loads | You suspect malware, or want to scan without an internet connection |
What is the order of steps?
The order below is ours, built from Microsoft’s description of the scan types; Microsoft does not publish a ranked sequence.
- Make sure Windows has the latest security intelligence: Protection updates, then Check for updates.
- Run a quick scan and read the Current threats section when it ends.
- If the PC still misbehaves, run a full scan. It takes longer because it checks every file and program.
- If you still suspect malware, save your work and run the offline scan, then read Protection history after the restart.
- For a single suspicious download or drive, use a custom scan of just that file or folder.
Microsoft says the Current threats section also lists quarantined and allowed items, and that you can reverse an item you allowed earlier by selecting it and choosing Don’t allow.
When should you use the offline scan?
Microsoft Defender Antivirus (offline scan) is meant for when you suspect malware or want to scan without an internet connection. Save your open files first, because the PC restarts. The scan runs in the Windows Recovery Environment before Windows loads, which makes it harder for persistent malware to hide, and the PC restarts again when it finishes. To see the results, open Protection history.
How do you keep protection current?
- Updates: Windows downloads security intelligence automatically through Windows Update. To check by hand, go to Protection updates and select Check for updates.
- Real-time protection: this scans files as they open or run. Microsoft says you can switch it off temporarily, but while it is off, opened or downloaded files are not scanned. If you only need to skip one file or folder, Microsoft recommends an exclusion instead.
- Allowed threats: if you previously allowed an item, you can reverse that by selecting it and choosing Don’t allow.
How do you protect files from ransomware?
Under Manage ransomware protection, Microsoft describes Controlled folder access. Once it is on, unknown or untrusted apps cannot change files in protected folders such as Documents, Pictures, Videos, Music and Desktop. You can add or remove protected folders under Protected folders. If an app you use is blocked, note its path, select the message, choose Add an allowed app and browse to the program. Microsoft warns to add only apps you trust, because a compromised allowed app could put the protected data at risk. Microsoft’s page also says OneDrive integration can guide you through restoring files after an attack.
Does Windows 10 still get protection?
Microsoft’s end-of-support notice says that after October 14, 2025, Windows 10 no longer receives technical assistance, feature updates or security updates, and that a PC still runs but faces greater risk from viruses and malware. A consumer Extended Security Updates programme can protect a Windows 10 device until October 12, 2027, for people who need more time to move to Windows 11. Microsoft’s page does not say how long Defender definition updates continue on Windows 10, so check that with Microsoft before relying on it. If your PC can run Windows 11, our guide to Windows 11 system requirements lists what it needs.
What should you do if you clicked something?
The FTC’s phishing guidance says that if you clicked a link or opened an attachment that may have installed harmful software, you should update your security software, run a scan and remove anything it flags. If a Social Security, credit card or bank account number may be exposed, the FTC points to IdentityTheft.gov for steps based on what was exposed.
- Run the scans above, starting with a quick scan and moving to full and offline scans if needed.
- From a clean device, change the passwords for important accounts and turn on multifactor authentication. Our guide to checking whether your password was leaked covers the next step.
- Contact your bank if money may be involved.
How do you reduce the risk of a repeat?
- Install software updates promptly and turn on automatic updates. CISA says to install every update, especially for web browsers and antivirus software, and to turn on automatic updates.
- Do not click links or open attachments in suspicious messages. CISA advises verifying through a website or number you already know. Our online safety guide collects the wider checklist.
- Keep a backup of photos and documents on an external drive or cloud storage, as the FTC and the UK’s NCSC both advise.
If the scan cannot remove a threat, or you handle sensitive data on the machine, ask a qualified technician for help. If the PC is slow but the scan is clean, our guide to fixing lag spikes in Windows 11 covers other causes.
FAQ
Is Windows Security enough? This guide does not rate it against other products; it covers what Microsoft says the built-in tools do.
What is the difference between a quick and a full scan? A quick scan checks the most likely locations; a full scan checks every file and program on the device.
Where do I see what a scan found? Under Current threats in Virus & threat protection, and for the offline scan under Protection history.
Does the offline scan need internet? No. Microsoft says it can be used to scan without an internet connection.
This page describes Microsoft’s documented steps only. We have not run these scans on test machines for this update, and menu names can change with Windows updates, so follow the labels shown on your own PC.
Sources
- Microsoft Support: Protect your PC with Windows Security
- Microsoft Support: Windows 10 support has ended
- FTC: How to recognize and avoid phishing scams
- CISA: Update software and Recognize and report phishing (both archived)
- NCSC: Top tips for staying secure online
Like our coverage? Add stepphase.com as a preferred source on Google to see more of our stories in Top Stories.
