How to Run a Malware Scan in Windows 11

If your Windows 11 PC started acting odd after a download, pop-up, or sudden slowdown, open Windows Security and run a malware scan right away. Go to **Virus & threat protection**, choose a scan type, and let Microsoft Defender check the system before you try anything else. A quick scan is the safest first pass. If the problem keeps coming back or looks deeply rooted, a full scan or Microsoft Defender Offline scan gives you a more thorough check.

Before you start, make sure Windows Security is available

Before you scan, make sure Windows Security can actually do the job.

• Sign in with an account that has admin rights if Windows asks for permission.
• Plug the laptop into power so the scan does not stop halfway through.
• Make sure Microsoft Defender is turned on. If another antivirus is installed, Defender may be limited or turned off.
• If Windows Security says protection is managed by another app, check that app first, because it may be in charge of scans.

If you just want a safe first pass, Windows Security is the right place to start. It is built into Windows 11 and can check files, apps, and running threats without you installing anything else.

Open Windows Security and get to Virus & threat protection

Open the Windows Security app, then go straight to the malware scanning area.

1. Select the Start button.
2. Type Windows Security.
3. Open the Windows Security app.
4. Select Virus & threat protection.

You should now see the current protection status, recent scan details, and scan options. If the page shows warnings, Defender wants attention before or after a scan. If Windows Security is missing from search, it may be disabled or replaced by another security app.

Choose the right scan for the situation

Pick the scan based on how suspicious the PC feels.

• Quick scan checks the places malware most often hides, such as running processes and common system locations. Use this first if you want a fast check after a weird download or pop-up.
• Full scan checks more of the PC, including files in many locations. Use this if the quick scan finds something, if the PC still feels off, or if you want a deeper pass after a quick scan comes back clean.
• Microsoft Defender Offline scan restarts the PC and scans before Windows fully loads. Use this if you think malware is hiding, resisting removal, or blocking normal security tools.

If you are not sure, start with a quick scan. If it finds nothing but the machine still behaves strangely, move to a full scan. If threats keep coming back, use the offline scan next.

Run the scan and wait for it to finish

Start the scan from the Virus & threat protection page.

1. Under Current threats, select Quick scan to begin a fast check.
2. If you want a deeper check instead, select Scan options.
3. Choose Full scan or Microsoft Defender Offline scan.
4. Select Scan now.

While the scan runs, Windows checks files, apps, and locations tied to the scan type you chose. You may see the scan progress update, and the PC can stay usable during a quick or full scan, though it may feel slower. For an offline scan, Windows will restart the computer and scan before normal startup.

A Microsoft Defender Offline scan will restart your PC. Save your work first, because anything unsaved can be lost when Windows restarts.

What to do if Windows finds threats

If Windows Security detects something, follow the action it recommends first.

In most cases, the safest choices are Quarantine or Remove:

• Quarantine moves the suspicious item out of normal use so it cannot keep running. This is a good choice if you are not sure the file is truly bad or you want to review it first.
• Remove deletes the threat. Use this when Windows identifies the item clearly as malicious and you do not need the file.

If Windows asks for a restart, go ahead and restart unless you have unsaved work. A restart is normal after some removals, especially when Defender needs to finish cleaning or confirm the threat is gone.

If the item is something you recognize and trust, do not rush to restore it. Only restore a quarantined file if you are sure it was flagged by mistake.

Check the scan results and make sure the warning is gone

After the scan, confirm two things: the scan completed and the threat status is clean.

1. Return to Virus & threat protection.
2. Look for the most recent scan result or last scan details.
3. Open Protection history if you want to review what was quarantined, removed, or blocked.
4. Check that any warning message is cleared or no longer showing on the security page.

If the scan ended normally, Windows Security should show a completed scan status and either no threats found or a record of how the threats were handled. If the scan is still running, wait until it finishes before judging the result. If you still see a warning, open the details so you can tell whether something remains quarantined, needs a restart, or needs another cleanup step.

If your PC still feels infected after the scan

If the computer still acts suspicious after one scan, take a second pass instead of assuming it is clean.

• Run another Quick scan if the first scan was interrupted.
• Run a Full scan if you only did a quick check the first time.
• Update Windows Security definitions first if the scan results seem stale or Defender says protection is out of date.
• Use Microsoft Defender Offline scan if pop-ups, redirects, strange startup behavior, or repeated detections continue.

If the PC keeps showing the same symptoms after the offline scan, the problem may be outside a simple Defender cleanup. At that point, keep your important files backed up carefully and review startup apps, browser extensions, and recently installed software for anything unfamiliar.

Common questions about malware scans in Windows 11

How long does a malware scan take? It depends on the scan type, how much data is on the PC, and how busy the system is. A quick scan finishes much sooner than a full scan. An offline scan also takes time because the PC restarts first.

Does a scan delete files? Not by itself. Windows Security usually quarantines suspicious items or removes them only if you approve that action or if the protection setting is set to handle threats automatically. Quarantine keeps the item isolated so it cannot run normally.

How often should you scan? If you think you may have downloaded something bad, scan right away. After that, a quick scan anytime the PC starts acting odd is a sensible habit. Windows Security also runs protection in the background, so you are not relying only on manual scans.

Can I use the PC during a scan? Usually yes for quick and full scans, though performance may slow down. You should save work first if the machine is already unstable, and you should expect a restart if you choose the offline scan.

Conclusion

Once the scan is done and the warning is cleared, keep an eye on the PC for a little while. If the same pop-ups, redirects, or slowdowns come back, run a full scan or an offline scan and check Protection history for anything that keeps reappearing. A clean result is a good sign, but repeated symptoms mean you should treat the machine as suspicious until Defender stops finding the same threat.

Frequently Asked Questions

Should I run Quick scan or Full scan first?

Start with Quick scan if you want a fast check after a suspicious download or pop-up. Use Full scan if the quick scan finds something or if the PC still looks infected afterward.

What does Microsoft Defender Offline scan do?

It restarts Windows and scans before the normal desktop loads. That helps when malware may be hiding or resisting removal.

Where do I see what Windows Security removed?

Open Windows Security, go to Virus & threat protection, and then open Protection history. That shows recent detections and what action was taken.