How to run a virus scan with Windows Defender on your PC

If you think your Windows PC might be infected, open Windows Security and run a Microsoft Defender scan right away. Start with a quick scan, then use a full, custom, or Microsoft Defender Offline scan if the symptoms point to something deeper. If Defender finds a threat, it can usually quarantine or remove it for you. If protection is turned off, that often means another antivirus app is in control or real-time protection was disabled.

Prerequisites

• A Windows PC with Windows Security available.
• Permission to open Windows Security and change security settings.
• If you want to scan a USB drive or folder, have it connected or easy to locate.
• If you plan to use Microsoft Defender Offline, save your work first in case Windows asks to restart.

Which scan should you run first

Start with a quick scan unless you already know the suspicious file or folder. A quick scan checks the places malware most often hides and is the fastest way to get a first answer.

Use a full scan if the PC still looks strange after the quick scan, or if you want Defender to inspect more of the system. Use a custom scan when you want to check one folder, a USB drive, or a specific download. Use Microsoft Defender Offline when malware seems hard to remove, keeps coming back, or blocks security tools.

If you are unsure, begin with a quick scan. If that comes back clean but the PC still acts oddly, move to a full scan or offline scan next.

Open Windows Security

1. Open the Start menu and type Windows Security.
2. Open the Windows Security app.
3. Select Virus & threat protection.

You should now see the page where Windows Defender scan and protection options live. If the page says protection is managed by another app, Windows is probably using a different antivirus program right now.

Run a quick scan

1. On the Virus & threat protection page, look for the Current threats area.
2. Select Quick scan.
3. Wait for the scan to finish and watch for any threat alerts.

A quick scan is the best first pass because it is fast and checks the places malware commonly starts from. If it finds nothing but your PC still seems suspicious, that does not automatically mean the machine is clean. It just means you should try a deeper scan next.

Run a full scan if you want a deeper check

1. Go back to Virus & threat protection.
2. Under Current threats, select Scan options.
3. Choose Full scan.
4. Select Scan now.

A full scan checks more of the PC than a quick scan, so it can take much longer. Use it when you want a more careful check, especially if you downloaded something questionable or noticed repeated pop-ups, strange browser behavior, or unexplained slowdowns.

If Defender is already busy or the PC is under heavy load, a full scan can take even longer than you expect.

Scan one folder or file with a custom scan

1. Open Virus & threat protection and select Scan options.
2. Choose Custom scan.
3. Select Scan now.
4. In the file picker, choose the folder, drive, or location you want checked.
5. Confirm your choice and let the scan run.

Use this when you want to check one suspicious download, a USB drive, or a folder with files you do not trust. For example, if you saved an attachment from email and it looks wrong, scan that download first instead of waiting on the whole computer.

A custom scan is also useful when you want to check a removable drive before opening files from it.

Use Microsoft Defender Offline for stubborn malware

1. Open Virus & threat protection and select Scan options.
2. Choose Microsoft Defender Offline scan.
3. Select Scan now.
4. Save any open work if Windows asks you to restart.
5. Let the PC restart and finish the scan before Windows fully loads.

An offline scan helps when malware may be hiding from normal scanning or actively stopping security tools from working. Because it runs before Windows fully starts, Defender gets a better chance to check and remove stubborn threats.

Expect the PC to restart and spend some time scanning before you can sign in again. Don’t interrupt it unless you have to.

What to do if Defender finds threats

If Defender finds a threat, follow the action it suggests. In many cases, Windows will quarantine the item automatically, which means it isolates the file so it can’t run or spread. Sometimes it can remove the item right away.

If Defender asks what to do, choose the safest option available, usually quarantine or remove. If a restart is requested, do it so the cleanup can finish.

After the restart, run another scan to make sure nothing else is left behind. If the threat came from a specific file, folder, USB drive, or download, keep that source disconnected or closed until you know it’s safe.

If Windows Security says protection is turned off, check whether another antivirus app is installed and active. Windows usually lets only one real-time antivirus product control the system at once. If you want to use Defender instead, uninstall or disable the other security app, restart the PC, and check Windows Security again. If you turned real-time protection off yourself, turn it back on and run another scan after it is active.

How to tell the scan really finished

Do not rely only on the spinning progress bar. To confirm the scan finished, go back to Virus & threat protection and check the Current threats area and any recent scan details.

Look for the last scan result, whether anything was found, and whether actions were completed. If Defender says no current threats are found and real-time protection is on, that is a good sign.

If you want another check, open Protection history from the same page. That list shows recent detections and actions, so you can see whether something was quarantined, removed, or blocked.

If the PC still seems suspicious after the scan, update Defender and run one more scan, preferably a full scan if you only ran a quick one before. Then check browser extensions, startup apps, and recently installed programs. If the browser keeps opening strange tabs or changing search settings, remove unfamiliar extensions and reset the browser’s settings if needed. If the PC still acts off after that, run a Microsoft Defender Offline scan next.

Also check that Windows Update is current, since security fixes can close gaps that malware uses.

Completion

The scan has finished when Windows Security shows the last scan result, Protection history reflects any actions taken, and Current threats reports no active problems or shows that detections were quarantined or removed. If the PC still behaves strangely after that, the next things to check are browser extensions, startup apps, recently installed programs, and whether Microsoft Defender Offline finds anything the regular scan missed.

Conclusion

If you only have a minute, start with a quick scan in Windows Security. If that does not explain the symptoms, move to a full scan, a custom scan, or an offline scan depending on what looks suspicious. After any detection, let Defender quarantine or remove the threat, restart if asked, and run one more scan to confirm the PC is clean. If the machine still behaves oddly, check browser extensions, startup apps, and Defender’s protection history next.

Frequently Asked Questions

Do I need to install antivirus software to scan with Windows Defender?

No. Windows Security already includes Microsoft Defender Antivirus on supported Windows PCs, so you can scan without installing anything extra.

What is the difference between quarantine and remove?

Quarantine isolates a suspicious file so it can’t run. Remove deletes it from the PC. If Defender offers either option, follow the safer choice it recommends for the detection.

Can I use the PC while a scan is running?

Usually yes, but the PC may feel slower during a full scan. If you start an offline scan, Windows will restart and you won’t be able to use the PC until it finishes.