Virus Scan on Windows 11? The One Scan Nobody Runs

Your PC feels off. It is slower than it was, or a page did something strange, and you want to know whether anything is on there.

Nine times out of ten nothing is. Windows can tell you for free, with nothing to install.

But four different scans sit behind one button, and the one that catches the awkward cases is the one almost nobody opens.

I have ordered this by what is worrying you, because the right scan depends on that rather than on which is most thorough. The commonest case turns out not to be a virus at all, so it goes first.

If a pop-up told you that you have a virus

Stop before you scan. Read what is on screen.

Documented by Microsoft on its tech support scams page, and this one sentence settles most of these: "Microsoft error and warning messages never include phone numbers."

Microsoft on how these reach you: "Scammers might also initiate contact by displaying fake error messages on websites you visit, displaying support numbers and enticing you to call."

⛔ So a warning with a phone number is not from Windows. It is a web page dressed as one, and calling that number is the actual attack.

Microsoft is equally direct about contact from the other side: "Microsoft does not send unsolicited email messages or make unsolicited phone calls to request personal or financial information, or to provide technical support to fix your computer."

⭐ Close the browser rather than the pop-up. If the window will not close, end the browser itself. Ctrl, Shift and Escape opens Task Manager, where you can close it. Reopen it. Decline to restore the tabs.

Once it is gone, run the quick scan below for peace of mind. Almost always it comes back clean, because nothing was ever installed.

Where all four scans actually live

One screen, and it takes about fifteen seconds to reach.

Open Start, type Windows Security, and open it. Go to Virus & threat protection, then under Current threats click Scan options.

Four choices appear there. Most people have never scrolled to the fourth.

If you just want a routine check

Quick scan is the default and it is the one that runs when you press the big button.

Microsoft's description of it, on the virus and threat protection page: "This option is useful when you don't want to spend the time running a full scan on all your files and folders."

It looks in the places malware has to be in order to run, which is why it takes minutes rather than hours. Windows also runs it on its own in the background.

Ours, and measured here: on the Windows 11 machine I checked, the last quick scan had run nine days earlier without anybody asking for it. A full scan had never been run at all. Windows reports that as a placeholder number rather than a date. Its way of saying never.

⭐ That is the normal state of a healthy PC, and it is worth knowing before you decide Windows has been neglecting you.

If you clicked something you regret

Then quick is not enough, because the thing you are worried about may be sitting somewhere that never runs on its own.

Microsoft on the full scan: it "Scans every file and program on your device".

Expect an hour or several, depending on how much is on the drive. It runs in the background and you can keep working. The machine will feel busier.

⚡ Custom scan is the one to use for a downloads folder or a USB stick. Microsoft describes it as scanning "only files and folders that you select", which turns an hours-long job into a couple of minutes on the part you care about.

The scan nobody runs, and when it is the only one that will do

This is the fourth option, and it is the reason for this article.

Microsoft Defender Antivirus (offline scan), in Microsoft's own words: it "Uses the latest definitions to scan your device for the latest threats. This happens after a restart, without loading Windows, so any persistent malware has a more difficult time hiding or defending itself."

Read the last clause again. Every other scan runs while Windows is running. Anything already loaded gets to watch and interfere. This one does not give it the chance.

Your PC restarts, scans outside Windows for roughly fifteen minutes, and restarts again into your desktop.

⚠️ Save your work before you start it. There is no prompt part way through and the restart is not optional once it begins.

⭐ Use it when a normal scan comes back clean and you still do not believe it. That is exactly the situation it exists for.

Why an offline scan looks like it failed

You will probably come back here and search at this exact point. It is not a fault.

An owner in February 2025 described it exactly: "It logged me out, rebooted, showed a progress screen of the percentage of files that had been scanned and then…..went to the login screen."

Then the four questions everybody has at that moment: "Did the offline scan work? Was it successful? Did it find any problems? I have no idea."

On that PC, Scan options still read Last Scan: Not Available. Protection history said no recent actions. Yours will look the same, and nothing anywhere will acknowledge that it happened.

Reported by a volunteer moderator on the same thread, and this is the answer: "If there is no news, it's good news. If the offline scan finds anything, it will show up in the threat history in Windows Security and in the msssWrapper log. Otherwise, nothing shows up in Windows Security; not even the timestamp of the last offline scan."

The owner confirmed it days later, having gone and read the log: "I did indeed get the Offline scan completed with 0x0000000 so I guess that everything is good."

The log sits at `C:\Windows\Microsoft Antimalware\Support\msssWrapper.log`. A line reading offline scan completed with 0x00000000 means yours finished cleanly.

Ours, and marked as ours: that folder does not exist on a PC where an offline scan has never run. I checked one and it was absent, which is a fair check in itself. If you cannot find the folder, the scan has not happened yet.

Is Windows Defender enough, or do you need to buy something

The question underneath most of these searches. Microsoft answers it, and I think the answer is worth quoting rather than paraphrasing.

Documented by Microsoft: "Microsoft security software protects you against malware, spyware, adware, and other unwanted software; you don't need to install any other real-time antivirus or antispyware software."

⚡ A vendor saying you do not need to buy anything else is unusual enough to take seriously.

Microsoft on stacking two products: "We recommend that you do not run other antivirus or antispyware products at the same time as Windows Defender." The stated reason is performance, because two real-time scanners inspect the same files twice.

⛔ And in practice you will not end up with two running at once. In Microsoft's words: "If you install a compatible non-Microsoft antivirus program Microsoft Defender antivirus will automatically turn itself off".

That last sentence explains a complaint I see constantly. Defender is not broken and did not fail. Something else took the job. Often a trial that shipped with the laptop. The trial then expired.

Check that protection is actually switched on

Worth thirty seconds, because everything above assumes it.

On the Virus & threat protection screen, look at Virus & threat protection settings. Real-time protection, cloud-delivered protection and tamper protection should all be on.

Microsoft on real-time protection, and this is the reassuring part: switched off, it "will turn back on automatically after a short while to resume protecting your device".

If you are also wondering whether you need to buy a firewall, Windows already ships one and it is on by default.

⭐ Tamper protection is the one to check hardest. Microsoft describes it as helping "prevent malicious apps from changing important Microsoft Defender Antivirus settings", which is precisely what something unwanted tries to do first.

⚡ The fast version, if you like a straight answer: open Windows PowerShell and run `Get-MpComputerStatus`.

It prints whether antivirus and real-time protection are enabled, whether tamper protection is on, and how long ago each scan ran. All on one screen.

What a scan will not tell you

Being straight about the limits, because a clean result is not always the end of it.

A scan finds malicious software. It does not find a browser extension quietly changing your search engine. Or a subscription you forgot. Or a machine that is simply old and full.

⚠️ If the complaint is speed rather than security, a slow PC usually comes down to two numbers. Neither of them is a virus.

⚠️ If the complaint is pop-ups inside one browser, that is usually an extension or a notification permission rather than an infection. No antivirus scan removes either.

Status: researched and written 23 August 2026 for the Windows Security app. Microsoft's own wording is quoted for all four scan options, for the offline scan running before Windows loads, and for its position that no other real-time antivirus is needed. The log path and completion code come from a February 2025 owner confirmation.

How do I run a virus scan on Windows 11?

Open Start, type Windows Security, and open Virus and threat protection. Quick scan runs from the button. For anything more, click Scan options underneath it, where full scan, custom scan and the Microsoft Defender offline scan are listed.

Is Windows Defender enough on its own?

Microsoft's own position is that its security software protects against malware, spyware, adware and other unwanted software, and that you do not need to install any other real-time antivirus or antispyware product. It also advises against running two at once, and Windows switches Defender off automatically when a compatible third-party antivirus is installed.

What does the Microsoft Defender offline scan do differently?

It restarts your PC and scans without loading Windows, so anything already running cannot hide from it or interfere. Microsoft describes it as making persistent malware have a harder time defending itself. It takes about fifteen minutes and restarts again when it is done.

Why did my offline scan show no results?

Because a clean offline scan reports nothing at all, not even a timestamp, which looks identical to a scan that never ran. Anything found appears in the threat history. To confirm it completed, open the msssWrapper log in the Microsoft Antimalware folder and look for the completion code.

Is that pop-up saying I have a virus real?

Almost certainly not, if it includes a phone number. Microsoft states that its error and warning messages never include phone numbers. It also states that scammers display fake error messages with support numbers to get you to call. Close the browser rather than the pop-up, then run a quick scan.

The Short Version

• A virus warning carrying a phone number is not from Windows. Microsoft says its messages never include one.
• All four scans live under Scan options, below the button on the Virus and threat protection page.
• Quick scan runs by itself in the background. On the PC I checked, one had run nine days earlier unasked.
• Full scan is for after you clicked something. Custom scan does one folder or a USB stick in minutes.
• The offline scan restarts your PC and scans without Windows loaded, which is why it catches what the others miss.
• A clean offline scan reports nothing at all, and that is normal. The log file is where the result actually is.
• Microsoft states you do not need any other real-time antivirus, and advises against running two together.
• Check that real-time and tamper protection are on. Get-MpComputerStatus prints all of it at once.

Where to Next

If a pop-up sent you here, close the browser and run a quick scan. That is the whole job, and it will almost certainly come back clean.

If a scan came back clean and you still do not trust it, run the offline scan tonight. Fifteen minutes, no decisions to make, and it is the only one that gets to look while nothing else is running.

If what actually bothers you is speed, the two numbers behind a slow machine will get you further than any scan will.

And if an offline scan does find something, name what it found below. Real results are hard to come by written up honestly, and I would rather collect them than guess.