Antivirus and antimalware software: FAQ (2024)

A quick scan will look for viruses and other malware in all the places they are most likely to hide. It’s a good choice when you’re just checking on the health of your PC.

If you think your PC is infected with malware, we recommend a full scan. Your PC might be a little slower while the full scan is running because it looks everywhere for possible problems.

• Make sure you've updated all of the apps on your PC. See Updating and removing software: FAQ for links to some common apps.

• You can also try to install the latest definitions, which may be more recent than those offered in your security software.

• Close any non-essential apps during the scan. Open apps take resources,even ones you're not actively using, and may cause your machine to perform more slowly or unreliably.

If you are still having problems, you can ask for help at the Microsoft virus and malware community.

Partially removed means we were able to clean some of the malware files that were found on your PC but perhaps not all of them.

We'll do our best to clean your PC as much as we can, but with some difficult malware you might need to take some additional steps:

First, run a full scan using the Malicious Software Removal Tool:

1. Open a Run prompt by pressing the Windows Logo Key + R or typing Run in the search box on the taskbar.

2. Type %windir%\system32\mrt.exe and select OK.
   

   Tip:To make it easier, select the command text in step 2 and press CTRL+C to copy, then paste it into the Run box using CTRL+V.

3. If you are prompted to allow the program to make changes to your PC, select Yes.

4. Follow the prompts to scan and clean your PC.

Next, restart your PC and then manually install the latest updates.

If you need more help, follow the steps on our advanced troubleshooting page. In some cases, you may need to useMicrosoft Defender Offline.

We recommend that you do not run other antivirus or antispyware products at the same time as Microsoft Security Essentials orWindows Defender.

Using more than one real-time security product can affect your PC's performance. You might also get an error code when you try to update or install, such as 0x80070643.

Microsoft security software protects you against malware, spyware, adware, and other unwanted software; you don't need to install any other real-time antivirus or antispyware software.

If you install our software, you should:

• Uninstall your previous security software

• Download and run the Microsoft Safety Scanner to clean any malware from your PC.

You can always download and run our on-demand security scanners, such as the Microsoft Safety Scanner or Microsoft Defender Offline. These scanners can be installed at the same time as any real-time security software because they only run when you've asked them to, or if you've set up scheduled scans.

Before the release of Windows 8.1, the name "Windows Defender" referred to a separate tool that only detected spyware. This tool is no longer supported, as antispyware is included in Microsoft Security Essentials and Microsoft Defender Antivirus.

Windows Defender is available in earlier versions of Windows 10, but in the most recent versions of Windows, Windows Defender is now called Windows Security.

To enable or disable Microsoft Defender Antivirus:

1. Select Start > Settings > Update & Security > Windows Security > Virus & threat protection.

2. Under Virus & threat protection settings, select Manage settings.

3. Under Real-time protection, change the setting to On or Off.

4. For optimal protection, turn on the settings for Cloud-delivered protection and Automatic sample submission.

Microsoft Defender Antivirus comes built-in to Windows 10 and Windows 8.1. You can turn off Microsoft Defender Antivirus if you decide to use a different security product.

Caution:Your device will be vulnerable to malware if you disable Microsoft Defender Antivirus and don’t have another security product.

If you don't have another security product, or it is expired, Microsoft Defender Antivirus will automatically turn on. You can also enable it manually if you don't already have a security product installed and working.

To learn more about Microsoft Defenderfor Endpointsee the Microsoft Defenderfor Endpoint page.

Updates should install automatically as part of Windows Update. For more information go to the Microsoft antimalware updates page.

Generally, you don’t need to do anything as the security software will clean the infection for you.

If unwanted software has been found on your device, you may be asked to choose what to do next. When this happens you will see a message in the bottom corner of your screen, where you can choose to select Clean computer or Show details.

If you choose Clean computer, the file is removed.

The Show details button lets you choose to either remove, quarantine, or allow the file.

Every threat is given an alert level to help you decide what to do.

This depends on how much you know about the file that has been detected.

• Remove deletes the file from your PC.

• Quarantine moves the file to a safe location and blocks it so it can't run.

• Allow adds the file to an allowed list and lets it run on your PC.

If you allow a file you won’t get any more alerts about it. Only allow a file if you trust the software and the software publisher.

On Microsoft Defender Antivirus for Windows 10 version 1703 and later:

1. Select Start > Settings > Update & Security > Windows Security > Virus & threat protection.

2. Under Current threats, select Threat history.

3. Under Quarantined threats, select See full history.

On earlier versions of Windows:

1. Open Microsoft Security Essentials or Windows Defender.

2. Select the History tab.

3. Select Quarantined items and then View details. You might be asked for an admin password or to confirm your choice.

Once you have reviewed the quarantined items you can:

• Select Remove all to delete all quarantined software.

• Select individual files, and then select Remove or Restore. Restore will move the file out of quarantine, back to its original location where you may choose to run it again.

• Select Quarantined items and then View details. You might be asked for an admin password or to confirm your choice.

Most files detected by Microsoft security software are quarantined. This means the file is moved and stopped from running or doing anything to your PC.

A quarantined file does not pose any risk to your PC. You can leave a file in quarantine for as long as you like.

Alert levels help you choose what to do when unwanted software is found on your PC.

Microsoft uses four alert levels:

• Severe—widespread or highly dangerous malware that can affect your privacy and damage your PC.

• High—programs that can collect your personal information or make changes to your PC.

• Medium—programs that might affect your privacy or change the way your PC behaves.

• Low—unwanted software that might collect information about you or your PC or change how your PC works.

Alert levels help you understand how dangerous a threat could be and decide what to do next.

To force a scan of a removable drive:

1. Open File Explorer.

2. Rick-click the removable drive.

3. Select Scan or Scan with <your security software's name>.

To always scan removable drives when you do a full scan:

1. Open your Microsoft security software.

2. Go to the Settings tab.

3. In the Advanced section, select the Scan removable drives check box.

4. Click Save changes. Whenever you do a full scan, all removable drives will also be scanned.

You can choose to exclude files from scanning if you know they are completely safe.

You should only do this for files you know are absolutely clean—if you are getting repeated warnings about a threat, first you should update your security software, and then check for any other important information about it in the malware encyclopedia.

Be careful—any files that you exclude will not be scanned, which could leave you open to infection. Only exclude files if you are absolutely sure they are not infected.

To exclude a file from scanning:

1. Go to Start and type Security.

2. Select Windows Security from the results

3. Go to the Virus & threat protection > Virus & threat protection settings > Add or remove exclusions.

4. Select Add an exclusion and follow the steps to set up an exclusion for a file, folder, file type or process.

For more information seeWhat are exclusions in Windows Security?

Your security software uses definitions to identify threats. They're a set of known patterns or behaviors that your security software compares software it scans to in order to determine if a file might be a threat.

Definitions are also knownas security intelligence, signatures, DAT files, pattern files, identity files, or antivirus databases.

Microsoft Defenderautomatically gets new security intelligence through Windows Update. You can manually force it to check for new security intelligence. On the Virus & threat protection page, underVirus & threatprotection updates, selectCheck for updatesto check for the latest security intelligence.

Go to the change log page.

You might not be able to update because:

• Malware has disabled your antivirus software.

• Malware has made changes to your PC so you can’t access the internet or security-related websites.

• There are other problems with Windows update.

• You're using Windows XP. See Windows XP support has ended for more info.

To resolve this, try manually installing the latest updates. If you still can’t update, go to our advanced troubleshooting page for more help.

Go to these sites for more help:

• The malware and infections help page on the Microsoft Defender Security Intelligence website

• The Microsoft Community Virus and Malware website

• The Contact Microsoft Support page

If you suspect a file includes malware or unwanted software you can submit it to us for analysis.