Think your PC has a virus? Scan it properly

Steps

1. 01

   See which antivirus is in charge

   • Open Start, type Windows Security and open it, then choose Virus & threat protection
   • If it shows scan buttons, Microsoft Defender Antivirus is protecting the PC — carry on to the next step
   • If it names another antivirus instead, open that program and run its own full scan; it has replaced Defender
   • For a second opinion alongside it, open 'Microsoft Defender Antivirus options' on the same page and turn on Periodic scanning

   Why?

   Microsoft's wording: if you install a compatible non-Microsoft antivirus, Microsoft Defender Antivirus turns itself off automatically. That is by design, not a sign of trouble.

   Also see: Skip paid antivirus — and keep Defender sharp

2. 02

   Update Windows, then run a full scan

   • Settings›Windows Update›Check for updates, and install what is offered
   • Windows Security›Virus & threat protection›Scan options›Full scan›Scan now
   • Keep the PC plugged in; you can carry on using it while the scan runs

   ✓You should see: A result when it finishes: either nothing found, or a list of what was found and what was done about it.

   Why?

   Microsoft describes a full scan as one that 'scans every file and program on your device', which is why it takes far longer than the quick scan.

3. 03

   Run Microsoft Defender Offline

   This scan runs after a restart, before Windows loads, so anything that hides while Windows is running has a harder time doing so

   • Save your work and close everything — the PC restarts as soon as the scan begins
   • Windows Security›Virus & threat protection›Scan options›Microsoft Defender Antivirus(offline scan) → Scan now
   • Leave it alone: it scans in the Windows Recovery Environment and restarts by itself when it is done

   ✓You should see: The PC back at the normal sign-in screen without you doing anything.

4. 04

   Read Protection history

   • Windows Security›Protection history
   • 'Threat blocked' means it was blocked and removed — nothing for you to do
   • 'Threat quarantined' means it is blocked but still stored — choose Remove
   • 'Threat found - action needed' is waiting for you — choose Quarantine
   • 'Remediation incomplete' means the clean-up did not finish — select the entry to expand it and follow the extra steps it lists, then restart and run the full scan again

   !Careful: Choose 'Allow on device' or 'Restore' only when you are certain the file is one you trust and Windows has made a mistake. If you are not sure, leave it quarantined — nothing breaks while you find out.

   Why?

   Protection history keeps events for two weeks, so read it soon after the scan. Red marks something serious; yellow marks something to look at when you can.

5. 05

   If it found something, follow up

   • Restart, then run the full scan once more and check it finishes with nothing found
   • Remove any program you did not mean to install
   • Change your important passwords from a different device, starting with email

   Also see: Kill shady 'PC optimizer' software · Think someone got into your accounts? Lock them down