Running a manual malware scan gives you direct control over your system’s security. While Windows Defender automatically monitors your PC in the background, a manual scan lets you investigate suspicious activity, clear lingering infections, or verify your system after downloading files from untrusted sources. This guide covers every scan type available in Windows 11 and explains how to handle the results without needing advanced technical knowledge.
Before You Start: Make sure your PC is connected to the internet and plugged into a power source. Manual scans, especially full system sweeps, can take several hours to complete. If you are using a work or school device, your IT administrator may have restricted scan options through Group Policy. Enterprise editions like Windows 11 Pro or Enterprise follow the same steps, though some settings might be managed by your organization’s security dashboard.
Step 1: Open the Windows Security App
Press the Windows key on your keyboard and type Windows Security into the search bar. Click the top result to launch the application. This app serves as the central hub for all built-in protection tools, replacing older security interfaces from previous Windows versions. If the app refuses to open, restart your computer and try again. Should the issue persist, navigate to Settings > Windows Update and install any pending updates, as outdated system files can sometimes block the security app from launching.
Step 2: Access the Virus & Threat Protection Menu
Click the Virus & threat protection tile located on the main Windows Security dashboard. This section houses your real-time scanning controls, scan history, and cloud protection settings. You will immediately see a Quick scan button and a Scan options link beneath it. If you do not see this tile, your account may lack the necessary permissions. Sign out and log back in with an administrator account, or contact your device manager if this is a corporate-issued machine.
Step 3: Choose Your Preferred Scan Type
Click the Scan options link to reveal the full menu of scanning methods. Windows Defender offers four distinct choices: Quick scan, Full scan, Custom scan, and Windows Defender Offline scan. The Quick scan checks folders where malware typically hides and finishes in minutes. The Full scan examines every file and running program across all connected drives, which can take several hours. Select Custom scan if you want to target a specific folder, external hard drive, or USB stick. The Offline scan restarts your PC into a pre-boot environment to catch stubborn threats that activate when Windows loads.
Step 4: Start the Scan and Monitor Progress
Click the Scan now button at the bottom of the Scan options page. Windows Defender will immediately begin analyzing your system and display a progress bar with an estimated time remaining. Your computer may feel noticeably slower during a Full scan, which is completely normal since the antivirus is reading every sector of your storage drive. If the scan freezes or shows zero progress for more than thirty minutes, press Ctrl + Shift + Esc to open Task Manager, locate Antimalware Service Executable, and end the task. Then restart the scan from Step 3.
Leave your PC plugged into power while the scan runs. Interrupting a Full scan can sometimes cause file indexing errors, and a battery-powered device might shut down before completion. You can switch to other applications, but avoid heavy gaming or video editing until the scan finishes.
Step 5: Review Results and Take Action
Wait for the scan to finish and review the results page that appears. If Windows Defender found threats, it will list each item with its severity level and current status. Click the dropdown arrow next to any detected item to choose between Quarantine, Remove, or Allow action. Quarantine isolates the file so it cannot execute, while Remove permanently deletes it from your system. If the scan reports no threats but you still suspect infection, proceed to the troubleshooting section below.
Troubleshooting Common Scan Issues
Issue 1: The scan will not start or immediately closes. This usually happens when another antivirus program is already active. Open Settings > Privacy & security > Windows Security > Virus & threat protection, and check the Manage settings toggle. If you see a message about another security provider, you must uninstall or disable that third-party software first. Windows Defender cannot run alongside competing real-time protection engines.
Issue 2: Threats keep reappearing after removal. Some malware modifies system files to reinstall itself. Boot into Windows Defender Offline scan mode by selecting it in Step 3 and clicking Scan now. This runs the antivirus before Windows loads, giving it unrestricted access to clean infected files. After the offline scan completes, restart your PC and run a second Quick scan to verify everything is cleared.
Issue 3: Scan results show Action Required but no details. Click the View scan history link at the bottom of the Virus & threat protection page. If the history is empty, your scan settings may be restricted by your account type. Sign in with an administrator account, open Windows Security, and verify that you have permission to modify protection settings. Standard user accounts on shared PCs often cannot run manual scans without admin approval.
Final Tips for Ongoing Protection
Enable automatic scanning by keeping the Real-time protection toggle switched on in the Virus & threat protection settings. This ensures Windows Defender continuously monitors new files and running programs without requiring manual intervention. You can also turn on Cloud-delivered protection to send suspicious file samples to Microsoft for faster analysis.
Schedule regular full scans if you frequently download files from untrusted sources or connect to public networks. Open Windows Security, click Scan options, and select your preferred scan type. While Windows does not natively schedule scans, you can create a simple task using Task Scheduler if you want automated weekly protection.
Keep Windows Defender updated by checking Settings > Windows Update > Update history. Microsoft pushes definition updates automatically, but manual checks ensure you have the latest threat database. If updates fail, run the Windows Update Troubleshooter from Settings > System > Troubleshoot > Other troubleshooters.
Pro Tip: Use the Custom scan option to target your Downloads folder and desktop every week. Malware often hides in recently opened files, and a targeted scan catches threats faster than a full system sweep while using less processing power.
Consider your account type when running scans on shared or family computers. Administrator privileges are required to remove certain high-level threats and modify protection settings. If you are signed in as a guest or standard user, ask the device owner to grant temporary admin access before starting your scan.
Over to you: Have you ever caught a hidden threat running a manual Defender scan?
