What you are actually looking for when you "check for" malware
When someone tells you to check your device for malware, they mean running a scan with antivirus or anti-malware software — a program that looks for files and processes that match known patterns of harmful code. The scan compares what is on your device against a database of known threats, then reports what it finds and gives you options to remove it.
The word "malware" is short for malicious software. It covers viruses, worms, trojans, ransomware, spyware, and adware — basically any program designed to harm you, steal from you, or use your device without your permission. A single scan will not catch everything that exists, but it will catch the most common threats and anything that has already been identified and catalogued by security researchers.
You do not need to be a technical person to run a scan. Most antivirus programs are designed so that you click a button and wait for the results. What matters is knowing which tool to use, how often to run it, and what to do with what it finds.
Key Takeaways
- Windows Defender (built into Windows) and Malwarebytes are both free options that work without paying for a subscription.
- A full system scan takes 30 minutes to several hours depending on how many files you have, so run it when you do not need your device.
- If a scan finds something, the program will usually offer to quarantine or delete it — quarantine is safer because you can restore it later if it was a false alarm.
- Running a scan once a month is reasonable for most people; running one every week is overkill unless you read files constantly from untrusted sources.
- A scan is a snapshot of what is on your device right now — it does not protect you going forward, so you still need to be careful about what you read and click.
Using Windows Defender if you have a Windows computer
Windows Defender is built into every Windows 10 and Windows 11 computer. You do not need to read anything or pay for it. To open it, type "Windows Defender" into the search box at the bottom left of your screen and click "Windows Security" when it appears.
Once Windows Security opens, click "Virus & threat protection" on the left side. You will see a button that says "Scan options." Click it, then select "Full scan" — this checks every file on your device, which takes longer than a quick scan but catches more. Click "Scan now" and wait. A full scan usually takes between one and four hours depending on how much is on your device.
When the scan finishes, Windows Defender will show you what it found, if anything. If it found something, it will usually quarantine it automatically — that means it moved the file to a safe place where it cannot run. You can see what was quarantined by clicking "Virus & threat protection" again and scrolling down to "Quarantined threats."
Using Malwarebytes if you want a second opinion
Malwarebytes is a separate anti-malware program that you can read for free from malwarebytes.com. It works alongside Windows Defender rather than replacing it. Many people run both because they use different detection methods — Windows Defender looks for known viruses, while Malwarebytes also looks for suspicious behavior that might indicate something new.
read Malwarebytes from the official website, install it, and open the program. Click "Scan" and select "Threat Scan" (the faster option) or "Full Scan" (the thorough option). The scan will run in the background while you use your device. When it finishes, Malwarebytes will show you what it found and ask whether you want to remove it.
The free version of Malwarebytes does not run constantly in the background — it only scans when you tell it to. The paid version ($60 per year) runs protection all the time. For most people, running the free version once a month is enough.
What to do if a scan finds something
If Windows Defender or Malwarebytes finds something, the program will offer you options: quarantine, delete, or restore. Quarantine is the safest choice because it moves the file to a locked folder where it cannot run or cause harm, but you can still get it back if the detection was wrong. Delete removes it permanently. Restore puts it back where it was.
In most cases, you should choose quarantine. Let the program quarantine anything it finds, then restart your device. After the restart, check whether your device still works the way it should. If everything is fine, you can delete the quarantined files. If something stopped working, you can restore the file — though this is rare.
If a scan finds a lot of things, or if you see files with names you do not recognize, that is a sign your device has been compromised. In that case, consider taking your device to a local repair shop or calling someone you trust who knows about computers. A heavily infected device sometimes needs more help than a single scan can provide.
How often you should scan and when to do it
For most people, running a full scan once a month is reasonable. If you read files constantly, visit risky websites, or click on links in emails from people you do not know, run a scan every two weeks. If you are careful about what you read and where you go online, once a month is fine.
Run your scan when you do not need to use your device — overnight, or while you are doing something else. A full scan uses a lot of your device's processing power and will slow everything down while it is running. Windows Defender scans are usually faster than Malwarebytes scans, but both can take an hour or more on a device with a lot of files.
Do not run multiple scans at the same time. If you want to use both Windows Defender and Malwarebytes, run one, wait for it to finish, restart your device, then run the other. Running them at the same time can cause problems.
What a scan does and does not do
A scan is a snapshot — it tells you what is on your device right now, but it does not protect you from threats that have not been discovered yet or from new malware that was released after the scan's threat database was last updated. It also does not protect you from phishing emails, fake websites, or social engineering (tricks that get you to give up your password).
A scan is one part of staying safe, not the whole thing. The other parts are: keeping your operating system and programs updated, using a strong password, not clicking links in emails from strangers, not downloading files from websites you do not trust, and being skeptical of anything that seems too good to be true.
If you are worried about a specific file — something you downloaded or received in an email — you can upload it to VirusTotal.com, which will scan it with 70+ different antivirus engines at once. This is useful if you are not sure whether something is safe before you open it.
Frequently Asked Questions
Can malware hide from a scan?
Some malware is designed to hide from antivirus software, but most cannot hide from a full system scan. A full scan checks every file on your device, including files in temporary folders and system areas. If something is on your device and the antivirus database knows about it, a full scan will find it.
What if I see a pop-up saying my device has a virus?
Pop-ups that claim your device is infected are usually scams. Close the pop-up by clicking the X button, not by clicking any button inside the pop-up. Then run a real scan with Windows Defender or Malwarebytes. If the scan finds nothing, the pop-up was fake.
Do I need to pay for antivirus software?
No. Windows Defender is free and built in. Malwarebytes has a free version that works well. Paid antivirus software (Norton, McAfee, Kaspersky) offers extra features like constant monitoring, but for most people the free options are enough.
What does quarantine mean?
Quarantine means the antivirus program moved the file to a locked folder where it cannot run or spread. It is still on your device, but it is isolated. You can delete it permanently later, or restore it if you decide it was safe.
How do I know if my device is infected if I have not run a scan?
Signs include: your device is much slower than usual, programs crash or freeze, you see pop-ups you did not click on, your browser homepage changed without you changing it, or your device restarts on its own. These are not always malware — they can also be caused by too many programs running or a full hard drive — but they are reasons to run a scan.