Scan for and remove malware with Microsoft Defender

This procedure uses only Windows Security, the app that comes with Windows 11 and 10. Allow about 15 minutes of your own time; the scans themselves can run longer while you do something else.

1. Save your work and close other apps

   A full scan reads every file on the drive, and the offline scan in step 4 restarts the PC. Save anything open, and close apps you do not need so the scan can finish faster.

2. Update Defender’s definitions

   Defender recognizes threats from a list of definitions that changes several times a day. Scanning with an old list can miss recent malware.

   1. Select Start, type Windows Security, and open it.
   2. Go to Virus & threat protection › Protection updates.
   3. Select Check for updates and wait until it says the definitions are up to date.

   If the update fails, connect to the internet and run Windows Update first, then try again.

3. Run a full scan

   The quick scan only checks the places malware usually hides. A full scan checks everything, which matters when you already suspect a problem.

   1. In Windows Security, open Virus & threat protection and select Scan options.
   2. Choose Full scan, then Scan now.

   Expect anything from 20 minutes to a couple of hours, depending on how many files you have. You can keep using the PC, though it may feel slower.

4. Run an offline scan

   Some malware hides while Windows is running. The offline scan restarts the PC into a small, separate environment and scans before Windows loads, so it can catch what a normal scan cannot.

   1. Go back to Virus & threat protection › Scan options.
   2. Choose Microsoft Defender Antivirus (offline scan), then Scan now, and confirm.

   The scan takes about 15 minutes, and the PC restarts on its own when it finishes.

5. Act on what Defender found

   Open Virus & threat protection › Protection history. Each entry shows what was found and what happened to it. Select an entry to see more and to choose an action.

   If the entry says	Then
   Removed or Quarantined	Nothing more to do. Quarantined files cannot run.
   Action needed, or Threat found	Choose Remove, then Start actions. Restart if asked.
   Remediation incomplete	Run the offline scan again, or start in Safe Mode and run a full scan from there.

6. Change passwords and check your browser

   If Defender removed something that could read what you type, such as a trojan or spyware, change the passwords for your email and bank, starting with email. Do this from a different, clean device if you can.

   Pop-ups or a changed homepage can survive a scan, because they often come from browser settings rather than files. Clear them with the browser clean-up procedure.

7. Confirm the PC is clean

   Restart, then run one more Quick scan. If it finds nothing and the original symptoms have gone, the procedure is complete.

   If the same threat keeps coming back, something is reinstalling it, often a program or browser extension you installed at around the time the trouble started. Remove recently installed programs under Settings › Apps › Installed apps (sort by install date), then scan again.