Scan Your Device for Malware Windows: Built-In Tools, Second-Opinion Scans, and What Full Scans Miss

Windows Security already scans your device for malware, and you can run a manual scan in about four clicks: Start > Settings > Privacy & security > Windows Security > Virus & threat protection > Scan options. Pick Quick scan, Full scan, or Microsoft Defender Offline scan, then click Scan now. The scan itself takes 5–20 minutes for a Quick scan and 60+ minutes for a Full scan on a typical laptop. Most Windows 10 and Windows 11 machines ship with Defender active, so you don't need to install anything to get a baseline check. What you do need is to understand which scan type actually catches the malware you're worried about, because a Quick scan deliberately skips most of your drive.

That matters more than most articles admit. Microsoft's own documentation for the Virus & threat protection panel lists four scan types — Quick, Full, Custom, and Microsoft Defender Offline — and each one covers a different surface. Picking the wrong one is the most common reason a scan comes back "No threats found" while the machine still behaves badly.

What Each Windows Scan Type Actually Checks

Quick scan inspects only the locations malware reliably hides in: running processes, the registry's autostart entries, the user profile folders, and the browser cache paths. Microsoft designed it to finish in minutes so it can run on a schedule without interrupting work. On a clean Windows 11 machine with a modern SSD, expect 5–15 minutes. It will not touch your Downloads folder, your Documents library, or a game installed on a second drive.

Full scan walks every file on every mounted volume the user can read, including archives and removable media attached at scan time. Microsoft's own guidance notes that Full scan can take over an hour and may exceed two hours on machines with large mechanical drives. It's the right choice after a suspected infection, after plugging in someone else's USB stick, or when Defender flagged something and you want a clean sweep.

Custom scan lets you aim the scanner at a single folder, a drive letter, or a mounted network share. Use it when you downloaded a file you don't trust but don't want to wait for a Full scan, or when a specific folder is behaving strangely.

Microsoft Defender Offline scan reboots the machine into a minimal recovery environment and scans from outside the running operating system. Microsoft added it to the Windows Security app specifically because some rootkits and bootkits can hide from a scanner that's running inside the infected OS. It takes roughly 15 minutes on modern hardware and will restart your PC when it finishes.

If a Full scan finds nothing but you're still seeing pop-ups or a hijacked browser, run Microsoft Defender Offline before trying anything more drastic. That sequence — Quick, then Full, then Offline — covers the majority of realistic threats without third-party tools.

Starting a Manual Scan Through the Windows Security App

The modern entry point is the Windows Security app, and the path is identical on Windows 10 22H2 and Windows 11 23H2/24H2 with minor cosmetic differences. You can also right-click the shield icon in the notification area to jump straight to the Virus & threat protection page. The buttons and labels below match what you'll see on a current build.

1: Open Start, type Windows Security, and press Enter. 2: Click Virus & threat protection in the left sidebar. 3: Under "Current threats," click Scan options. 4: Select Quick scan, Full scan, Custom scan, or Microsoft Defender Offline scan. 5: Click Scan now. If you chose Custom, browse to the folder or drive first. 6: Leave the machine powered on and plugged in for Full and Offline scans — sleep mode can interrupt them.

If the scan stalls at a fixed percentage for more than 20 minutes on a Full scan, that's usually a locked file rather than a hang; open Task Manager, confirm MsMpEng.exe is still using CPU, and give it another 15 minutes. If Defender says "Threats found" but the action button is greyed out, you're likely signed in with a standard account. Sign in as an administrator and re-run the action. And if Windows Security itself won't open, run Get-AppxPackage Microsoft.SecHealthUI -AllUsers | Reset-AppxPackage in an elevated PowerShell window to repair the app package.

Scheduling Scans Without Burning Battery or Work Hours

Windows Security runs a scheduled scan by default, but the default is a Quick scan at a time Microsoft chooses based on your idle patterns — usually around 2 a.m. if the machine is left on. You can inspect and change that schedule under Windows Security > Virus & threat protection > Manage settings > Protection updates, then Task Scheduler Library > Microsoft > Windows > Windows Defender > Windows Defender Scheduled Scan for the actual trigger. Changing the trigger there is the only reliable way to make a Full scan run weekly at a specific hour.

The battery math matters. A Full scan pegs one CPU core and keeps the disk busy; on a laptop, that can drain 15–25% of a battery in an hour depending on the drive. Schedule Full scans for when the machine is plugged in. Quick scans are cheap enough to leave on the default schedule.

Microsoft's "Windows Defender Scheduled Scan" task has a default timeout of three days, which is generous. If you change the trigger to run during lunch and the machine sleeps, the task will resume on wake and finish in the background. You can verify a scan actually ran by opening Windows Security > Protection history and filtering by "Scan" — Microsoft logs every scheduled and manual scan there with a timestamp.

When to Run Defender Offline Instead of a Normal Scan

Rootkits and bootkits are the class of malware that defeats an in-OS scanner because they intercept file system calls before the scanner sees them. Microsoft Defender Offline circumvents that by booting a minimal Windows Preinstallation Environment (WinPE) image and scanning from outside the live kernel. Microsoft's own malware encyclopedia documents this approach for threats categorized as "Trojan:Win32/Rootkit" and similar.

The trigger conditions to run it are specific. You see Defender detect and "remove" the same threat repeatedly across reboots. Your browser homepage changes back to a hijacked URL after every restart. Task Manager shows a process name you don't recognize running as SYSTEM with no publisher. Or Windows won't fully boot and you want to scan before deciding on a reinstall.

The scan takes roughly 15 minutes, but because the machine reboots twice — once into the offline environment, once back to normal Windows — set aside 30 minutes. Save your work first; the reboot is not graceful. Defender Offline needs roughly 1 GB of free space on the system drive for its scan database.

One gotcha: on Windows 11 24H2, some OEM recovery partitions block the Offline scan from mounting its image. If the machine boots back into normal Windows immediately without a scan, check Event Viewer > Windows Logs > System for a Defender event around the timestamp — the cause is usually a partition table quirk, and the workaround is running the Offline scan from a Windows installation USB created with the Media Creation Tool.

Second Opinions Worth Running Alongside Defender

Defender's detection rate is genuinely strong in independent testing — AV-TEST's periodic Windows 10 and Windows 11 home-user reports consistently place Microsoft Defender in the top tier for protection, and AV-Comparatives' real-world protection tests have awarded it Advanced+ ratings in recent years. But no single engine catches everything, and running a second-opinion scanner is standard practice after any suspicious event.

The catch is that running a second real-time antivirus alongside Defender disables Defender's real-time protection and creates conflicts. Windows deliberately turns off its own protection when a third-party AV registers in Security Center. The safe pattern is a second-opinion on-demand scanner — one that only runs when you launch it and doesn't register as your primary AV.

Kaspersky Lab's Virus Removal Tool and ESET's Online Scanner are both portable single-purpose scanners — download, run, delete when done. Microsoft Safety Scanner uses the same engine as Defender but with definitions packaged on the download date, which matters if Defender's own update service has been tampered with. Malwarebytes Free is the one most guides recommend, and it's genuinely good at the adware class (browser hijackers, bundled toolbars) that Defender tends to leave alone if it's only nuisance-grade.

If you want a full real-time AV from a third party — Bitdefender, ESET, Norton, Kaspersky — that's a different decision, and Defender will step aside automatically once it registers.

Reading the Scan Result: Protect, Quarantine, Remove, Allow

Defender's post-scan panel uses four action verbs that behave differently, and misreading them is where people get into trouble. The threat name and category follow Microsoft's malware naming convention: Trojan:Win32/Emotet!ml means the Trojan family, the platform (Win32), the family name (Emotet), and the !ml suffix flags a machine-learning heuristic hit rather than a signature match.

Quarantine moves the file to Defender's encrypted vault at C:\ProgramData\Microsoft\Windows Defender\Quarantine. The file can't execute but can be restored for 90 days. Remove deletes the file. Allow adds the file or hash to Defender's exclusions and stops future detection. Clean attempts to strip the malicious payload from an infected file, which works for older macro viruses and almost never for modern droppers.

Treat !ml detections differently from signature hits. A heuristic hit on a small custom tool you wrote or downloaded from a niche source is often a false positive — check the hash against VirusTotal before clicking Remove. A signature hit on a file you don't recognize is almost always correct. For allowed items, exclusion management lives under Virus & threat protection > Manage settings > Exclusions, and each exclusion you add is a permanent blind spot.

Protection history keeps detections for roughly 30 days by default. If you need to prove a scan happened for a support ticket or a work audit, screenshot the Protection history entry before it rolls over.

Third-Party Scanners: When Defender Alone Isn't Enough

Defender is the right default on Windows 10 and 11, but there are legitimate reasons to run something else. The clearest one is an enterprise environment where a corporate policy mandates a specific AV — Defender handles this gracefully by going dormant. The second is a specific detection gap: a piece of software you use gets flagged as a false positive by Defender every update, and you need an engine that doesn't.

For most home users, Defender plus an occasional second-opinion scan is the right answer. Full-time third-party AV adds real-time layers (behavioral blocking, ransomware rollback, web filtering) that Defender now also has, sometimes better. The independent labs are the authority here — check AV-TEST's most recent home-user report and AV-Comparatives' Real-World Protection test before paying for any AV, because the top tier changes every quarter.

Free AV suites from Avast, AVG, and similar vendors have a well-documented history of bundling upsells and occasionally selling "anonymized" browsing data through their marketing arms. Microsoft doesn't do that with Defender. That's a real reason to stay with Defender unless a lab report gives you a specific reason not to.

If you run Windows on an old machine — say a 2015 laptop with a spinning hard drive — Defender's Full scan can take three to four hours. A third-party lightweight scanner may finish faster, but the actual protection difference is small. Budget the time rather than switching products.

False Positives, Locked Files, and Scans That Won't Finish

A scan result isn't a verdict, and the most expensive mistake is deleting a file a scan falsely flagged. Installers, cracked tools (which you shouldn't run anyway), niche utilities from small developers, and .NET assemblies packed with certain obfuscators all trip heuristics regularly. Before clicking Remove, right-click the file in Protection history, copy the SHA-256 hash, and paste it into VirusTotal — a site operated by Google. Anything flagged by more than 5 of the 60+ engines is worth investigating; a single-engine flag on a known-good file is usually a heuristic misfire.

Locked files are the second common complaint. A Full scan reporting "...files could not be scanned" is normal; files in use, files in password-protected archives, and files with restricted NTFS permissions get skipped. Don't assume skipped equals infected. If you need those files scanned, close the app using them and re-run a Custom scan on that folder.

Scans that hang at a fixed percentage for over 30 minutes on a Full scan typically mean a corrupt file or a disconnected network drive mounted under a local path. Disconnect external drives and network shares before a Full scan, then reattach. Scans that crash Defender entirely can be repaired with Settings > Apps > Installed apps > Microsoft Defender and the repair option, or via the PowerShell reset command mentioned earlier.

One edge case worth knowing: Windows Sandbox and Windows Subsystem for Linux (WSL) environments are scanned by Defender, but malware inside a WSL ext4 filesystem isn't accessible to the Windows scanner. If you suspect WSL-side compromise, run a Linux scanner (ClamAV is free) from inside the WSL distro — Defender can't see that filesystem.

Why Your Windows Scan Takes So Long and What to Turn Off

A Quick scan that runs five minutes one week and forty the next is normal and usually reflects disk activity from other apps. A Full scan that takes four hours on a machine that finished in ninety minutes last month almost always means one of three things: an antivirus engine update is running concurrently, Windows Update is downloading in the background, or the system drive is a mechanical hard disk that's fragmented.

Real-time monitoring (also called real-time protection) makes every scan slower because each file open triggers a signature check before the scanner gets to it. Turning it off during a scan is a bad trade — you're creating exactly the window malware wants. Leave it on.

The one setting worth changing is Cloud-delivered protection, under Windows Security > Virus & threat protection > Manage settings. Microsoft's cloud service can return a verdict on new or low-prevalence files in seconds; when it's off, Defender has to wait for the next signature update. Microsoft's own documentation recommends leaving it on. The same page hosts Automatic sample submission, which sends suspicious files to Microsoft — off by default would be safer for privacy but slower for detection; on is the detection-optimizing choice.

If a scheduled scan keeps interrupting work, don't disable it — move the Task Scheduler trigger to a time you're not using the machine. The protection value is real; the timing is the controllable variable.

After a Positive Result: Cleanup Steps That Actually Matter

A scan that finds and quarantines malware is only the first step. The malware ran before it was caught, and the damage it did — credential theft, persistence mechanisms, scheduled tasks — survives removal of the original file. The sequence below is what security professionals run, adapted for home users.

1: Note the threat name and the file path from Protection history. Screenshot it. 2: Run a Full scan after quarantine to catch droppers the initial hit may have pulled in. 3: Run Microsoft Defender Offline if the threat name includes "rootkit" or "bootkit," or if the same threat reappears within 24 hours. 4: Change passwords for anything that was signed in on the machine — email, banking, browser sync — from a different device. 5: Check Task Scheduler and Startup apps (Task Manager > Startup) for entries you didn't create. 6: Review Windows Security > App & browser control to confirm SmartScreen is still enabled; malware often disables it. 7: If the machine held business data, financial data, or identity documents, run a full reinstall from a USB created with the Media Creation Tool. This is the only way to be sure.

Reinstallation sounds drastic, and for a single adware hit it is. For targeted banking trojans, infostealers, or anything that had admin rights during its infection window, it's the difference between "probably clean" and "clean."

FAQ

Does Windows Defender actually scan for malware, or is it just a basic tool?

Defender is a full antivirus engine, not a stripped-down tool, and independent labs have confirmed its protection tier repeatedly. AV-TEST's home-user Windows reports place Microsoft Defender among the top performers for protection, performance, and usability in most cycles, and AV-Comparatives has awarded it Advanced+ ratings for real-world protection. The gaps show up more in adware class and in specifics like URL reputation breadth, not in core malware detection. For a home user with current updates, Defender is sufficient without a third-party AV.

How long should a Windows full scan take on a typical laptop?

A laptop with an SSD and 500 GB of data typically finishes a Full scan in 60–90 minutes; the same machine with a mechanical hard drive and 1 TB used space often takes three to four hours. Windows Security logs the actual scan duration under Protection history with a start and end timestamp — check that rather than relying on the progress bar, which is notoriously approximate. If a Full scan runs four times longer than the last one on the same data, something is slowing the disk rather than the scanner.

Is Malwarebytes a replacement for Windows Defender?

No, Malwarebytes Free is an on-demand scanner, not a full AV replacement, and installing Malwarebytes Premium alongside Defender causes Defender to turn off its real-time protection. If you want Malwarebytes Premium as your primary AV, that's a valid choice, and Defender will gracefully step aside — but running both real-time engines side by side isn't possible and won't double your protection. The safe pattern is Defender as primary AV plus Malwarebytes Free for occasional second-opinion scans on suspicious downloads.

Can a scan find malware that's hiding in my browser extension?

Windows Security scans browser extension files on disk, which catches most malicious extensions, but it can't inspect what an extension does at runtime. Extensions installed from the Chrome Web Store or Edge Add-ons are subject to those stores' review processes, and malicious extensions are removed within days to weeks of reporting — but that's days too late if it already had access to your browsing. Check chrome://extensions or edge://extensions periodically and remove anything you don't recognize. Defender's browser integration, SmartScreen, filters known-bad download and phishing URLs but not extension behavior.

What's the difference between a "threats found" result and a "Potentially Unwanted App" flag?

Potentially Unwanted Apps (PUAs), now labeled "Potentially Unwanted Software" or PUS in some Defender builds, are the category for bundlers, adware, miners, and tools with aggressive monetization. Defender's default action is to detect and quarantine PUAs only if you've enabled the "Block potentially unwanted apps" toggle under App & browser control > Reputation-based protection. A "threats found" result refers to genuine malware detections. The two are logged separately in Protection history and require different judgment calls — a PUA is a nuisance, malware is a security incident.

Do I need to run a scan after every Windows update?

No, running a scan after every Windows Update is unnecessary. Patch Tuesday updates don't reintroduce malware; they close vulnerabilities. Defender's real-time protection runs continuously anyway. The right cadence is a scheduled Quick scan weekly, a Full scan monthly or after any suspicious download, and a Microsoft Defender Offline scan only if you have specific reason to suspect a rootkit. Running more scans than that just costs you disk I/O and battery life without improving safety.

Can malware disable Windows Security before my scan starts?

Yes, some malware families — particularly older banking trojans — disable Defender's real-time protection, tamper with the scheduled scan task, or remove Defender's Security Center registration. If Windows Security won't open, shows a warning that protection is managed by your organization, or the settings panels are greyed out, that's the symptom to look for. Run Microsoft Safety Scanner (a standalone executable that uses Defender's engine from outside the OS install) or boot the machine into Microsoft Defender Offline to scan before Windows loads. A fresh reinstall is the safest recovery if the tampering succeeded.

Are free third-party antivirus tools safe to run alongside Defender?

Free on-demand scanners like ESET Online Scanner, Kaspersky Virus Removal Tool, and Microsoft Safety Scanner are designed to run alongside Defender without registering as a full AV, so Defender's real-time protection stays on. Free full AV suites (Avast Free, AVG Free, Avira Free) do register as primary AVs and will turn Defender's real-time protection off. The on-demand tools are safe; the full suites aren't any worse, but they come with the tradeoffs of a single engine plus in-app upsells and, for some vendors, a documented history of data-sharing through the marketing arm. For a one-off second opinion, pick an on-demand scanner.