How to Scan for Viruses with Microsoft Defender in Windows

Open Windows Security from the Start menu, choose Virus & threat protection, and click Quick scan. A few minutes, and for almost every situation that is the correct scan to run.

And if it comes back clean and you find that suspicious — it is supposed to.

Real-time protection has already checked those files. Defender examines every file as it is opened, closed or written, continuously, in the background. By the time you sit down and run a scan, anything you have actually used has been through the scanner already.

So a manual scan is not a second opinion on your daily activity. It is a look at the files you have not touched. A clean result is the expected outcome, not a sign the tool is asleep.

The other thing worth unlearning: a quick scan is not a shallow version of a full scan. They do different jobs. Quick checks the places malware has to register itself to survive a restart. Full reads every file on every disk. Microsoft recommends the quick one — and the reason is genuinely interesting.

The Customer Who Did Not Believe the Good News

A customer brought a laptop into Jake's shop convinced it had a virus. It had been slow for a fortnight, a browser tab had opened by itself once, and he had run Windows Security four times. Every scan came back No current threats.

He did not find that reassuring. He found it suspicious. His reasoning was reasonable enough: something is clearly wrong, the scanner says nothing is wrong, therefore the scanner is not doing its job. He had downloaded two other scanners to check its work, and they had found nothing either, which had convinced him the problem was deeper still.

Jake ran a fifth scan, which also found nothing, and then did something more useful: he opened Task Manager and looked at what was actually running at startup. Three browser extensions the customer did not recognize, and a "PC optimizer" that had arrived with something else.

None of them were viruses. All of them were the reason the machine was slow and a tab had opened by itself. Defender had not missed anything, because there was nothing of its kind to miss.

Ethan's take, when Jake described the afternoon: "He'd decided what the answer was and then judged the tool by whether it agreed with him. But a clean scan is information — it tells you to stop looking for a virus and start looking for something else. Most people treat it as the tool failing to confirm their theory."

Understanding what a scan actually examines is what turns "no threats found" from a non-answer into a useful one. And it starts with the fact that most of the checking happened before you clicked anything.

Why Your Scan Finds Nothing

Microsoft Defender is not primarily a thing you run. It is a thing that runs constantly.

Real-time protection examines every file as it is opened, closed or written, plus anything in folders you access. Download a file and it is checked before you can use it. Open an attachment and it is checked. Copy something from a USB stick and it is checked on the way in.

Which means that by the time you decide to run a manual scan, every file you have actually touched has already passed through the scanner — often several times, and against newer definitions each time.

So what is a manual scan for? It looks at the files you have not been using. An old archive you have not opened in two years. A folder restored from a backup. Files that were on the disk before the current definitions existed. That is genuinely worth checking occasionally, and it is also why the answer is usually nothing.

A clean scan result is the expected outcome on a healthy machine. It is not the tool being lazy, and it is not evidence that something clever is hiding — though there is one specific scan for that possibility, and it is covered further down.

If your machine is misbehaving and scans keep coming back clean, that combination is telling you something useful: look at unwanted programs, browser extensions and startup items rather than at viruses. They are far more common, they are not technically malware, and most scanners deliberately leave them alone.

The Four Scans and What Each One Is For

In Windows Security, open Virus & threat protection and click Scan options. Four choices, and they are not four sizes of the same thing.

Scan	What it examines	Use it when
Quick minutes	The places malware must register to start with Windows — registry keys, startup folders, running processes	Almost always. This is the default answer.
Full hours	A quick scan first, then every file on every fixed drive in sequence	A machine you have just inherited, or after a genuine infection
Custom depends	Exactly the folder or drive you point it at	A download, a USB stick, one suspicious folder
Offline ~15 min + restart	The disk, from outside Windows, before it loads	Something keeps returning after you remove it

The fourth is the one people have never heard of and it is the most powerful of the four, because it runs before Windows is loaded and therefore before anything hiding inside Windows can conceal itself. Our guide to Microsoft Defender Offline covers what it is and when it is genuinely the right tool — it deserves its own page rather than a paragraph here.

Quick Versus Full: A Different Job, Not a Shorter One

The names invite a wrong assumption: that quick is the rushed version and full is the proper one, so a careful person runs full scans.

What actually separates them is where they look, not how hard they look. Same engine, same definitions, same detection.

A quick scan targets the places a piece of malware is forced to occupy if it wants to survive a restart — registry run keys, startup folders, the processes currently in memory. Anything that wants to be running tomorrow has to be in one of those places, so that is where a quick scan goes.

A full scan begins with exactly that quick scan, then continues into a sequential read of every file on every fixed disk. It is not looking harder. It is walking further, into files that are dormant and cannot do anything until something opens them — at which point real-time protection would check them anyway.

This is why Microsoft's own recommendation is a quick scan alongside real-time and cloud protection, rather than routine full scans. It is not a compromise for slow machines. It is the combination that covers the threats that matter.

Ethan's version, which Jake now uses on the counter: "A full scan is checking every drawer in the house for an intruder. A quick scan is checking the doors, the windows and the person standing in your kitchen. If something's actually broken in, you find it at the second one — and you find it in four minutes instead of six hours."

If you want scans happening on a schedule rather than when you remember, that is its own topic with its own trade-offs, and our guide to scheduling automatic scans covers it — including what Microsoft advises about which scan to schedule.

Running Each One

1. Open Windows Security. Press the Windows key, type Windows Security, press Enter. It is also the shield icon in the notification area.
2. Choose Virus & threat protection. The quick scan button is right there if that is all you need.
3. For anything else, click Scan options beneath the button, choose your scan, and click Scan now.
4. For a custom scan, you are asked to browse to a folder or drive after clicking Scan now. Pick the parent folder rather than individual files.
5. For a single file, folder or USB stick, skip the app entirely: right-click it in File Explorer and choose the option to scan with Microsoft Defender. Same engine, three clicks fewer.

Scanning a USB stick you have been handed is genuinely worth the ten seconds, and our guide to scanning a USB drive covers the specifics, including why plugging one in does not automatically scan the whole thing.

One habit worth having before a scan that matters: update the definitions. Virus & threat protection → Protection updates → Check for updates. Definitions normally arrive several times a day on their own, so this is usually unnecessary — but a machine that has been switched off for a month is a machine scanning with month-old definitions.

Reading the Result Properly

"No current threats." Nothing was found in the areas that scan covers, and real-time protection has nothing outstanding. On a quick scan, remember what that means precisely: the persistence locations are clean. It is a real result, and it is not a claim that every file on the disk has been examined.

Something was found. Do not act from the notification. Work through it in this order instead:

1. Breathe. Defender has almost certainly quarantined the item already, which means it is contained and cannot run. You have time to look at this properly rather than deciding in a hurry.
2. Open Protection history in Virus & threat protection and click the entry. This tells you what was detected, where it was, and what has already been done about it.
3. Read the detection name. Names containing PUA mean potentially unwanted applications — toolbars, optimizers, bundled extras. Not viruses, but generally worth removing.
4. Choose the action. Remove deletes it. Quarantine keeps it contained but recoverable. Allow tells Defender to stop flagging it.
5. Run a second scan afterwards to confirm it is gone. If the same detection returns, something running is putting it back, and the Offline scan is the answer rather than another removal.

Allow is the one to be careful with. Use it only when you know exactly what the file is and why it was flagged — "it is probably a false positive" is what people think immediately before discovering it was not. A file you did not deliberately install is never a candidate for Allow.

One category worth understanding rather than fearing: hack tools and similar names attached to software you installed on purpose are usually accurate descriptions rather than mistakes. Defender is telling you what the file is capable of, not accusing you of anything.

Two categories are worth understanding rather than fearing. Detections named as PUA or potentially unwanted applications are usually toolbars, optimizers and bundled software — not viruses, but generally worth removing. And hack tools or similar names attached to files you deliberately installed are often accurate descriptions rather than mistakes; Defender is telling you what the file can do, not accusing you of anything.

When the Scan Will Not Run or Finish

Symptom	Likely cause	What to do
Scan button does nothing	A scan is already running in the background	Wait a few minutes, or restart and try again
Real-time protection is off and will not switch on	A third-party antivirus is installed, or its remnants are	Remove it properly with the maker's own removal tool
Quick scan runs for hours	Stuck on a file, or a failing disk	Restart, retry, then check the drive's health
Windows Security will not open at all	The app or its underlying service is damaged	Repair system files with DISM then SFC
Same detection returns after every removal	Something is reinstating it from a running process	Run the Offline scan — this is precisely its job

Row two is the most common by a distance. Trial antivirus software that came with a laptop leaves pieces behind when uninstalled the ordinary way, and Defender will not turn itself back on while it believes another product is protecting the machine. Almost every antivirus maker publishes a dedicated removal tool for exactly this, and it is worth using rather than fighting Windows.

Row five is the situation where the Offline scan stops being an obscure option and becomes the only sensible answer.

Defender Alongside Another Antivirus

Install a third-party antivirus and Defender steps aside on its own. It switches its real-time protection off, updates its status to show the other product as active, and stops competing. That is deliberate, because two scanners fighting over the same file at the same moment causes real problems.

You are not left with nothing, though. Defender can still run as a second opinion through a setting called periodic scanning, which lets it perform occasional background checks without taking over. Our guide to Defender running alongside other antivirus programs covers where that setting lives and when it is worth enabling.

The honest position on whether you need the third-party product at all: for most people, no. Defender performs comparably with paid suites in independent testing, it is already there, it updates through Windows Update, and it does not spend your afternoons asking you to upgrade. Buy a paid product when it does a specific thing you actually need — not on the assumption that free means weaker.

And whichever you use, real-time protection is the part doing the work. Our guide to real-time protection covers what it does and why turning it off "just for a minute" is the moment most infections actually arrive.

What This Page Said in 2016

The original version of this post went up in July 2016 and showed how to open Windows Defender and start a scan. The steps were right for that version of Windows, and the equivalent steps are still at the top of this page.

What has changed underneath them is the whole shape of the product. In 2016, Defender was much closer to a thing you ran: real-time protection existed but was less capable, cloud protection was in its infancy, and the Offline scan was a separate download you put on a USB stick rather than a button in the app. Advice from that period reasonably treated the manual scan as the main event.

Today the manual scan is the smallest part of what protects you, and the useful advice is about choosing between four options and knowing what a clean result actually tells you. Those are the questions readers arrive with now, and the 2016 page did not answer either of them.

The product name changed too, from Windows Defender to Microsoft Defender Antivirus, which is why older guides, newer guides and the app itself sometimes appear to be describing different software. They are not.

Your Questions, Answered Straight

How do I run a virus scan with Microsoft Defender?

Open Windows Security from the Start menu, choose Virus & threat protection, and click Quick scan. For the other options, click Scan options first and pick from the four available. A quick scan takes a few minutes and is the right choice for almost every situation.

Why does my scan never find anything?

Because real-time protection already examined those files. Defender checks every file as it is opened, closed or written, so anything you have actually used has been through it. A manual scan is looking at files you have not touched, which is why a clean result is the expected outcome rather than a suspicious one.

What is the difference between a quick scan and a full scan?

They do different jobs rather than the same job at different depths. A quick scan checks the places malware must register itself to survive a restart, such as registry keys and startup folders. A full scan runs a quick scan first and then reads every file on every fixed disk, which can take hours.

Should I run a full scan regularly?

No. Microsoft's own recommendation is a quick scan alongside always-on real-time protection and cloud protection, because that combination covers malware that starts with the system. Full scans mostly re-read files that real-time protection has already cleared, at considerable cost in time and battery.

What are the four scan options in Windows Security?

Quick scan for the usual persistence locations, Full scan for every file on every fixed drive, Custom scan for one folder or drive you choose, and Microsoft Defender Offline scan, which restarts the machine and scans before Windows loads. Each answers a different question, and picking the right one saves hours.

How do I scan a single folder or a USB drive?

Right-click the folder or drive in File Explorer and choose the option to scan with Microsoft Defender. You can also use Scan options in Windows Security, select Custom scan, click Scan now, and browse to what you want checked. Both do the same thing.

How long should a scan take?

A quick scan is usually a few minutes. A full scan depends entirely on how much data you have and can run from about an hour to most of a day on a large drive. If a quick scan is taking hours, something is wrong and it is worth restarting the machine and trying again.

What does it mean when Defender says no current threats?

It means nothing was found in the locations that scan covers, and that real-time protection has not flagged anything either. It is a genuine result rather than a formality. What it does not mean is that every file on the machine has been examined, unless the scan you ran was a full one.

Defender found something. What should I do?

Open the Protection history entry and read what it actually says before acting. Defender usually quarantines automatically, in which case the item is already contained. Choose Remove for genuine threats, and only choose Allow if you are certain the file is safe and you know why it was flagged.

Is Microsoft Defender good enough on its own?

For most people, yes. It scores comparably with paid products in independent testing, it is built into Windows, it updates through Windows Update, and it does not try to sell you anything. The strongest argument for a paid suite is a specific feature you actually need rather than better detection.

Can I run Defender alongside another antivirus?

Not as an active scanner. When you install a third-party antivirus, Defender steps aside automatically and turns its real-time protection off to avoid two products fighting over the same files. You can still enable periodic scanning so Defender runs occasional checks in the background as a second opinion.

How do I make sure the definitions are current before scanning?

In Windows Security, open Virus & threat protection, then Protection updates under Virus & threat protection updates, and click Check for updates. Definitions usually arrive several times a day through Windows Update, so this is rarely necessary, but it is worth doing before an important scan.

Why will my scan not start or finish?

The usual causes are another security product still installed, a scan already running in the background, or damaged system files underneath. Restart, check no third-party antivirus is present, and if it still fails run the system file repair tools before assuming Defender itself is broken.

Does scanning slow my computer down?

A quick scan is barely noticeable on modern hardware. A full scan reads every file on the disk and will make the machine feel slower while it runs, particularly on a spinning hard disk. Defender lowers its own priority when you are actively using the computer, so it is less disruptive than it used to be.

Should I scan in Safe Mode?

There is rarely any need. Safe Mode was the traditional answer for malware that hides from a running system, and Microsoft Defender Offline scan now does that job properly by scanning before Windows loads at all. Use the Offline scan rather than Safe Mode when you suspect something is hiding.

Does this apply to Windows 11 as well as Windows 10?

Yes. The scan types, the Windows Security app and every step here work the same on both. The product has been renamed over the years from Windows Defender to Microsoft Defender Antivirus, which is why older guides and the app itself sometimes use different names for the same thing.

Worth Reading Next

Revision note. Originally published July 2016, when Windows Defender was much closer to a tool you ran than a service that runs constantly. Rewritten August 22, 2026 for Windows 11 and Windows 10. The steps to start a scan are still here and still simple. What is new is everything around them: why real-time protection means a manual scan usually finds nothing, what genuinely separates a quick scan from a full one, which of the four options fits which situation, and how to read a result rather than just receive it. The product has also been renamed from Windows Defender to Microsoft Defender Antivirus along the way. If your machine is misbehaving and every scan comes back clean, please write in and tell us what it is doing — that combination usually points somewhere specific, and it is rarely a virus. And if a clean result has been worrying you rather than reassuring you: that is the answer working, not the tool sleeping.