What malware looks like and where to find it

Malware is software designed to harm your computer or steal your information. It hides in different places depending on what kind it is. Some malware runs in the background and you'll never see it; other kinds change your browser homepage or fill your screen with pop-ups. The most reliable way to find it is to run a dedicated scanning tool rather than hunt for it manually, because malware is designed to stay hidden.

Your computer gives you clues that malware might be present. Your machine runs slower than usual. Your browser shows ads you didn't click on. Programs start without you opening them. Your antivirus software (if you have it) shows warnings. These signs don't always mean malware — a slow computer can have other causes — but they're worth investigating.

Key Takeaways

  • Run a full system scan with Windows Defender (built into Windows) or a free tool like Malwarebytes to search your entire computer for malware at once.
  • Restart your computer in Safe Mode before scanning, because malware is harder to hide when Windows loads only essential programs.
  • Check your browser extensions, startup programs, and installed software list for unfamiliar names, which is where malware often hides in plain sight.
  • If a scan finds malware, let the tool quarantine or remove it, then restart your computer and run the scan again to make sure it's gone.

Running a full system scan with Windows Defender

Windows Defender is built into Windows 10 and Windows 11 and scans for malware without you installing anything. Open the Windows Security app by clicking the Windows icon in your taskbar, typing "Windows Security," and pressing Enter. Click "Virus & threat protection" on the left side.

Click "Scan options" and select "Full scan," then click "Scan now." A full scan checks every file on your computer and takes 30 minutes to several hours depending on how much data you have. Let it run without interrupting it. When the scan finishes, Windows Security will tell you if it found anything. If it did, click "Remove" or "Quarantine" and restart your computer.

If Windows Defender is turned off, you'll see a warning at the top of the Windows Security window. Click it and turn the protection back on before scanning. Some malware disables Windows Defender on purpose, so if you can't turn it back on, you may need to use a different tool.

Using Malwarebytes if Windows Defender doesn't find anything

Malwarebytes is a free tool that catches malware Windows Defender sometimes misses. Go to malwarebytes.com, click "Free Download," and run the installer. Open Malwarebytes when it finishes installing and click "Scan" on the left side. Select "Threat Scan" and click "Start Scan." This scan is faster than Windows Defender's full scan and usually takes 10 to 20 minutes.

Malwarebytes will show you what it found when the scan ends. Click "Quarantine" to remove the threats. Restart your computer and run the scan again to confirm the malware is gone. If Malwarebytes finds nothing but your computer still has symptoms, the problem might not be malware — it could be a hardware issue, too many programs running at startup, or a browser problem.

Checking your browser extensions and startup programs

Malware often hides as a browser extension or a startup program that runs when you turn on your computer. These are places you can look manually while a scan runs in the background.

In Chrome, click the three dots in the top right, go to "Extensions," and look at the list. Remove anything you don't recognize or don't remember installing. In Firefox, click the three horizontal lines in the top right, click "Add-ons," and do the same. In Edge, click the three dots, go to "Extensions," and remove unfamiliar ones.

To check startup programs in Windows 10 or 11, right-click the Windows icon in your taskbar, click "Task Manager," and click the "Startup" tab. Look for programs you don't recognize. Right-click any suspicious entry and click "Disable." Disabling a startup program doesn't remove it — it just stops it from running when you start your computer, so you can turn it back on if you disabled something by mistake.

Restarting in Safe Mode before scanning

Safe Mode is a Windows startup option that loads only the essential programs your computer needs to run. Malware is harder to hide in Safe Mode, so scanning while in Safe Mode catches more threats. To restart in Safe Mode, click the Windows icon, type "msconfig," and press Enter. Click the "Boot" tab, check the box next to "Safe boot," and click "OK." Windows will ask if you want to restart now — click "Restart."

Your computer will start with a black background and "Safe Mode" in the corners of the screen. Run your malware scan now using Windows Defender or Malwarebytes. When you're done scanning and have removed any threats, restart your computer normally. Go back to msconfig, uncheck "Safe boot," and click "OK" to return to your regular startup.

What to do if you can't remove the malware

Some malware is stubborn and won't let you remove it, or it comes back after you delete it. If a scan finds malware but the removal fails, try restarting in Safe Mode and scanning again — malware has less protection in Safe Mode. If that doesn't work, try a different scanning tool. Malwarebytes catches some threats that Windows Defender misses, and Windows Defender catches some that Malwarebytes misses.

If multiple scans find nothing but your computer still has symptoms, the problem might not be malware. A slow computer can be caused by a full hard drive, too many startup programs, or a failing hard drive. A browser that shows unwanted ads might have a problem with your browser settings rather than malware. Before assuming your computer is infected, run a scan, check your startup programs, and check your browser extensions — those three steps catch the vast majority of malware problems.

Preventing malware in the future

The easiest malware to deal with is malware you never get. Keep Windows updated by going to Settings, clicking "Update & Security," and clicking "Check for updates." Windows updates patch security holes that malware uses to get in. Don't open email attachments from people you don't know. Don't download software from websites that look suspicious or misspelled. Use your browser's built-in password manager instead of letting websites save your passwords, because malware that steals passwords can't steal what it can't find.

Turn on Windows Defender if it's off, and leave it on. It runs in the background and uses very little of your computer's power. If you use a different antivirus program, make sure it's actually running — some people install antivirus software and then forget about it. Check your browser extensions once a month and remove anything you don't use. These habits won't may provide you'll never get malware, but they make it much less likely.

Frequently Asked Questions

How long does a full malware scan take?

A full scan with Windows Defender usually takes 30 minutes to two hours, depending on how much data is on your computer and how fast your hard drive is. Malwarebytes' threat scan is faster, usually 10 to 20 minutes. You can use your computer while a scan runs, though it will be slower.

Can malware hide from Windows Defender?

Yes. Some malware is designed to avoid detection by Windows Defender specifically. That's why running a second scan with Malwarebytes or another tool is useful — different tools catch different threats. If two different scanners find nothing, malware is unlikely to be your problem.

What does quarantine mean?

Quarantine means the scanning tool moved the malware to a separate folder where it can't run or harm your computer. You can usually delete quarantined files permanently from the scanning tool's settings. Quarantine is safer than immediate deletion because if the tool made a mistake, you can restore the file.

Is it safe to disable startup programs?

Yes. Disabling a startup program doesn't remove it — it just stops it from running when your computer starts. If you disable something important by mistake, you can turn it back on in Task Manager. Most startup programs are safe to disable if you don't recognize them or don't use them.

Do I need to pay for malware removal?

No. Windows Defender is free and built in. Malwarebytes has a free version that scans and removes malware. Both tools do a thorough job without paying anything. Be cautious of websites that claim you need to pay for malware removal — some of those sites are scams.