Windows Defender runs automatic background scans by default, but there are moments when you need to take control. Maybe you downloaded a suspicious file, noticed unusual system behavior, or you are preparing a secondhand PC for a fresh start. Running a manual malware scan gives you immediate visibility into what is hiding on your drive. This guide walks you through the exact steps to trigger a custom scan using the built-in Windows Security app on Windows 11.
Before You Start: Make sure your PC is connected to the internet and signed into a Microsoft account. Windows Defender relies on the latest definition updates to recognize modern threats, so an active connection ensures the scanner checks against current malware signatures. If you are running a third-party antivirus, Windows Defender will pause its real-time protection automatically, and you will need to use that vendor’s scanner instead.
Step 1: Open Windows Security
Press Win + I to launch the Settings app. This keyboard shortcut opens the main configuration hub where Windows stores all security and privacy controls. You will see a grid of categories on the left sidebar. If the Settings window opens to a different section, do not worry, you can navigate forward in the next step. Pressing this combination is the fastest way to reach the security dashboard without clicking through multiple menus.
Step 2: Navigate to Virus & threat protection
Click the System & security tile, then select Windows Security from the submenu. You will see a new page load with four large buttons representing core protection areas. Click the Open button inside the Windows Security card to launch the dedicated security hub. This screen displays your protection status at a glance and shows a green checkmark if real-time scanning is active. If the button is grayed out, your system may be managed by an organization policy, which is common on enterprise or work-issued devices.
Step 3: Choose a scan type
Scroll down to the Virus & threat protection section and click the Scan options link. Windows Defender offers four distinct scanning modes, each designed for a different threat level. Quick Scan checks memory, startup folders, and system directories for known malware signatures. Full Scan examines every file on your active drives, which takes significantly longer but catches deeply hidden threats. Custom Scan lets you pick specific folders or drives to review. Microsoft Defender Offline Scan restarts your PC and runs the check before Windows loads, bypassing any malware that tries to hide during normal operation.
Step 4: Start the manual scan
Select your preferred scan type and click the Scan now button. The system will immediately begin reading your storage drives and comparing file hashes against its malware database. A progress bar appears at the bottom of the window, showing the percentage completed and an estimated time remaining. Do not shut down or restart your computer while the scan runs, as interrupting the process can leave temporary files in an inconsistent state. If the button does not respond after a few seconds, wait another minute, as heavy drive activity can cause a brief UI delay.
Step 5: Wait for the scan to complete
Leave your PC powered on and allow the scanner to finish its run. Depending on your drive size and scan type, this process can take anywhere from fifteen minutes to several hours. You can switch to other applications, but keeping the Windows Security window visible helps you monitor progress without switching contexts. If you notice your system becoming unusually slow, that is normal during a Full Scan, since the scanner prioritizes drive access. Once the progress bar disappears and the status changes to Complete, the results will appear directly in the same section.
Step 6: Review and handle detected threats
Click the View results link to see a detailed list of any flagged items. Windows Defender will categorize findings by severity and show you the file path, threat name, and recommended action. You can choose to Quarantine items to isolate them safely, Remove them to delete the files entirely, or Allow them if you are certain the detection is a false positive. After making your selections, click Apply to confirm. If the scanner reports no threats, your system is currently clean according to the latest definition set.
Troubleshooting common issues
Even built-in tools can run into hiccups. Here are the most frequent problems users encounter when manually scanning for malware, along with fixes you can apply right away.
- Scanner refuses to start or shows an error code: Open an elevated Command Prompt by searching for
cmdin the Start menu, right-clicking the result, and selecting Run as administrator. Typewsreset.exeand press Enter. This resets the Windows Store cache and often clears stuck security service states. Restart your PC and try the scan again. - Scan completes instantly with no results: This usually means your definition updates are outdated. Click the Virus & threat protection section, then select Check for updates under Windows Defender Antivirus definitions. Wait for the download to finish before running another manual scan.
- Real-time protection keeps turning off: If you disabled it manually, Windows will not re-enable it automatically. Navigate back to Virus & threat protection settings and toggle Real-time protection back on. If it flips off repeatedly, a scheduled task or group policy may be interfering, which is typical on domain-joined enterprise machines.
Pro Tip: Schedule a weekly Quick Scan through the Scan options page by clicking Change settings under Automatic scanning. This keeps your system under routine observation without requiring you to remember to run the check manually.
Running a manual malware scan is a straightforward way to verify your system health whenever something feels off. Windows Defender handles the heavy lifting in the background, but knowing how to trigger and interpret those scans puts you in control of your digital security. Keep your definition updates current, review scan results promptly, and do not ignore repeated alerts from third-party security software.
Have you ever caught a hidden threat by running a manual Windows Defender scan?
Over to you: Have you ever caught a hidden threat by running a manual Windows Defender scan?
