How to Run a Malware Scan in Windows 11

To run a malware scan in Windows 11, open Windows Security, select Virus & threat protection, and select Quick scan under Current threats. For a deeper check, select Scan options on the same page, choose Full scan, and select Scan now.

Applies to: Windows 11 with the built-in Microsoft Defender Antivirus. Checked against Microsoft Support on October 7, 2026.

Before you start

Windows 11 includes an antivirus program called Microsoft Defender Antivirus, which many people still call Windows Defender. You control it from the Windows Security app, so there is nothing to download or pay for. It already checks files in the background through a feature called real-time protection. A manual scan is an extra check that you start yourself, for example after a suspicious download, an odd pop-up, or a sudden slowdown.

• Check which antivirus is in charge. If another antivirus program is installed, Microsoft says Microsoft Defender Antivirus turns itself off automatically, and the scan buttons described here will not be the ones you see. Use that program’s own scan instead, or see the troubleshooting section below. If you are unsure, here is how to check what antivirus you have on Windows 11.
• Get the latest threat definitions. In Windows Security, go to Virus & threat protection > Protection updates > Check for updates. This downloads the newest security intelligence, which is the list Windows uses to recognize current threats.
• Save your work before an offline scan. Quick, full, and custom scans run while you keep using the PC. The offline scan restarts the computer, so it needs more preparation. It has its own section below.

Which scan should you run?

Windows Security offers four scans. Microsoft’s guidance is to use a quick scan in most cases, because real-time protection already covers the files you open and download.

Scan	What it checks	Use it when
Quick scan	The places where malware registers itself to start with Windows, such as registry keys and the Windows startup folders	You want a routine check or a fast answer after something looked suspicious
Full scan	Every file and program on your device	A quick scan found something, or you want the whole PC checked and can leave it running
Custom scan	Only the files and folders that you select	You want to check one download, one folder, or a USB drive
Microsoft Defender Offline scan	The PC after a restart, without loading Windows	You suspect an infection that keeps coming back or that the other scans cannot remove

Run a quick scan in Windows Security

1. Open Windows Security. Select Start, type Windows Security, and open the app from the results. The app opens on a page of protection areas.
2. Select Virus & threat protection. This page has a Current threats section at the top. It shows any threats found on the device, plus when the last scan ran, how long it took, and how many files were scanned.
3. Select Quick scan. The scan starts right away and the page shows its progress. You can keep working while it runs.
4. Read the result. When the scan ends, the Current threats section either reports that nothing was found or lists the threats that need your attention.

Microsoft describes the same page in Virus and threat protection in the Windows Security app. That article also includes a link that opens the Virus & threat protection page for you.

Run a full scan

A full scan checks every file and program on the device, so it takes far longer than a quick scan. The time depends on how much is stored on the PC. Start it when you will not need the computer at full speed for a while, and plug in a laptop first so the battery does not run out partway through.

1. Open Windows Security and select Virus & threat protection. You land on the page with the Current threats section.
2. Select Scan options. You will find it in the Current threats section, near the Quick scan button. A list of scan types appears.
3. Select Full scan. This is the option that scans every file and program on the device.
4. Select Scan now. The scan begins and shows its progress on the same page. Leave the PC switched on until it finishes.

Scan one file, folder, or drive

You do not need a full scan to check a single download or a USB stick. There are two documented ways to scan only what you choose.

From File Explorer

1. Right-click the file or folder. The short Windows 11 right-click menu opens.
2. Select Show more options. The longer classic menu appears.
3. Select Scan with Microsoft Defender. Windows Security opens on the scan options page and shows the result for that item.

Microsoft covers this method in Scan an item with Windows Security.

From Windows Security

1. Go to Virus & threat protection and select Scan options. The list of scan types appears.
2. Select Custom scan, then select Scan now. Windows asks which location you want to scan.
3. Choose the folder or drive to check and confirm. Only that location is scanned, and the result appears on the same page.

Run a Microsoft Defender Offline scan

Some malware hides while Windows is running. The offline scan restarts the PC and scans it from outside the normal Windows session, where that kind of threat cannot protect itself. Microsoft suggests it when you suspect an infection or want to confirm that a PC is clean after one. Windows Security may also show a notification asking you to run it.

Warning: the PC signs you out and restarts within about a minute of starting this scan. Save every open file and close your programs first.

Check these requirements, which come from Microsoft’s documentation:

• You are signed in with an administrator account.
• The PC runs the x64 version of Windows 11. Microsoft lists Windows 11 on ARM as not supported for the offline scan.
• The Windows Recovery Environment is turned on. The troubleshooting section shows how to check.
• If BitLocker drive encryption is on for the system drive, Microsoft advises suspending it before the scan. Otherwise you may be asked for the BitLocker recovery key, so have it ready.

1. Open Windows Security and select Virus & threat protection.
2. Select Scan options. The list of scan types appears.
3. Select Microsoft Defender Offline scan, then select Scan now. On some versions the option’s name is worded slightly differently, but it always includes the word offline. A message reminds you to save your work.
4. Select Scan. Windows asks for permission to make changes to the device.
5. Select Yes. Windows signs you out and shuts down in less than a minute. The scan screen looks different from a normal scan because Windows itself is not loaded.
6. Wait for the scan. Microsoft says it takes about 15 minutes. The PC restarts again by itself when the scan is done, and Windows loads normally.

To see what the offline scan found, open Windows Security and select Protection history. The full requirements are in Microsoft’s Microsoft Defender Offline scan documentation.

Run a scan from Command Prompt or PowerShell

The same scans can be started with commands. This is useful when the Windows Security app will not open, or when you want to put a scan in a script. The commands below are taken from Microsoft’s documentation.

Command Prompt

1. Open the Start menu and type cmd.
2. Right-click the Command Prompt result and select Run as administrator. Microsoft states that the scan tool must be run from an elevated Command Prompt.
3. Type one of these commands and press Enter. The tool is named MpCmdRun.exe and is stored in the Windows Defender folder under Program Files.

• Quick scan: “%ProgramFiles%\Windows Defender\MpCmdRun.exe” -Scan -ScanType 1
• Full scan: “%ProgramFiles%\Windows Defender\MpCmdRun.exe” -Scan -ScanType 2
• Custom scan of one folder: “%ProgramFiles%\Windows Defender\MpCmdRun.exe” -Scan -ScanType 3 -File “C:\Users\YourName\Downloads”
• Cancel a running quick or full scan: “%ProgramFiles%\Windows Defender\MpCmdRun.exe” -Scan -Cancel

Replace the example folder with the one you want to check. A command-line scan stops by itself if it runs past a time limit: seven days for a full scan and one day for the other types, according to Microsoft’s MpCmdRun reference.

PowerShell

Open PowerShell as an administrator and use the Start-MpScan command:

• Quick scan: Start-MpScan -ScanType QuickScan
• Full scan: Start-MpScan -ScanType FullScan
• One folder or drive: Start-MpScan -ScanType CustomScan -ScanPath “D:\”
• Offline scan: Start-MpWDOScan (the PC restarts immediately, so save your work first)

A full scan can take a long time. Add -AsJob to the end of the command to run it as a background job, so you can keep using the PowerShell window. Microsoft’s Start-MpScan reference lists the accepted scan types.

Check the results and deal with threats

After any scan, look in two places in Windows Security:

• Current threats on the Virus & threat protection page shows threats found on the device and the details of the last scan: when it ran, how long it took, and how many files it checked. If that time matches the scan you just ran and no threats are listed, the scan completed cleanly.
• Protection history keeps the record of what Windows Security found and did, including the results of an offline scan.

When a threat is listed, select it to see what Windows Security recommends and follow that action. Threats that were stopped are quarantined, which means the file is locked away where it cannot run or affect the PC.

If you earlier told Windows Security to allow an item and now think that was a mistake, open Allowed threats from the Current threats section, select the item, and select Don’t allow. Windows Security will treat it as a threat again.

After a scan removes something, run a second quick scan to confirm the PC is clean. If the threat allowed someone to see what you typed, change your important passwords from a different device that you trust.

Troubleshooting

The scan buttons are missing and another antivirus is named

When a non-Microsoft antivirus program is installed, Microsoft Defender Antivirus switches itself off, and the Virus & threat protection page shows the other product instead. To confirm which one is active, select Manage providers under Who’s protecting me?. You have three choices:

• Run the scan from the other antivirus program.
• Uninstall the other program. Microsoft Defender Antivirus should turn back on automatically.
• Keep both and turn on limited periodic scanning. On the Virus & threat protection page, select Microsoft Defender Antivirus options below the other product’s name and switch the toggle to On. The standard scan options then appear. Microsoft notes that this mode uses only a small part of Microsoft Defender Antivirus and is not a replacement for a main antivirus.

Real-time protection is off

On the Virus & threat protection page, select Manage settings under Virus & threat protection settings and switch Real-time protection to On. Windows turns this setting back on by itself after a short while, so if it stays off, another antivirus or an organization policy is usually the cause. Our guide on turning Windows Defender off and on in Windows 11 explains that switch in more detail.

Settings are locked on a work or school PC

On a computer managed by an employer or school, the organization can control antivirus settings, and some options may be unavailable to you. Report suspected malware to your IT support team instead of trying to work around the restriction.

The offline scan does not start

Check the requirements above first: an administrator account, an x64 PC, and the Windows Recovery Environment. To check the recovery environment, open Command Prompt as an administrator and run reagentc /info. If it is reported as disabled, run reagentc /enable and start the offline scan again.

The PC asks for a BitLocker recovery key

This can happen when an offline scan runs on a drive protected by BitLocker. Enter the recovery key to continue. Next time, suspend BitLocker protection before starting the offline scan.

MpCmdRun is not recognized as a command

Include the full path in quotation marks exactly as shown above, and make sure Command Prompt was opened with Run as administrator. Newer copies of the tool are also stored in a version-numbered folder under C:\ProgramData\Microsoft\Windows Defender\Platform. Microsoft lists both locations, and the newest copy is in the Platform folder when that folder exists.

The threat comes back after it is removed

Update the security intelligence with Check for updates, run a Full scan, and then run a Microsoft Defender Offline scan. The offline scan is designed for threats that survive scans made while Windows is running.

Frequently asked questions

Do I need to scan by hand at all?

Not routinely. Real-time protection checks files as you open and download them. A manual scan is worth running after a suspicious download or attachment, when the PC starts behaving strangely, or when you plug in a drive from someone else.

Can I use my PC during a scan?

Yes for quick, full, and custom scans, although the PC may feel slower during a full scan. No for the offline scan, which restarts the PC and runs before Windows loads.

How long does a scan take?

A quick scan checks a limited set of locations and is the fastest. A full scan checks every file and program, so its length depends on how much is stored on the PC and how fast the drive is. Microsoft puts the offline scan at about 15 minutes.

Will a scan delete my personal files?

A scan acts only on items it identifies as threats. Those are quarantined, and you can review them in Protection history. Your other files are left alone.

How do I scan a USB drive?

Plug it in, open Windows Security, and use Custom scan to pick the drive. To check a single file or folder on the drive, right-click it in File Explorer, select Show more options, and select Scan with Microsoft Defender.

Where is Windows Defender in Windows 11?

It is part of the Windows Security app. Search for Windows Security from Start. The antivirus itself is named Microsoft Defender Antivirus and its controls are on the Virus & threat protection page.

Is it the same in Windows 10?

Very nearly. Windows 10 uses the same Windows Security app and the same scan types. See how to scan for and remove malware in Windows 10 for that version.

Start with a quick scan today, and if it reports anything, follow it with a full scan and check Protection history to confirm the threat was dealt with.

Related: How to stop Norton from blocking a program.