The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →If you downloaded a suspicious file, don’t open it again. Scan the file with Microsoft Defender, then run a PC scan in Windows Security. If you ran the file or the problem persists, update Defender’s security intelligence and move on to a Full scan or Microsoft Defender Offline. A clean result is reassuring, but it cannot prove that no malware is present.
First, don’t interact with the download
Do not open, run, or try to delete the suspicious file by launching it. If you only downloaded it and never opened it, locate it in File Explorer and scan that item: right-click the file or its containing folder and choose Scan with Microsoft Defender. On some Windows 11 systems, the option is under Show more options. Microsoft documents this targeted scan in its Windows Security app guidance.
If Defender detects a threat, follow the recommended quarantine or removal action rather than restoring or opening the file. Do not turn off real-time protection or add the file to Defender exclusions to get around a warning: files accessed while real-time protection is off are not checked in real time, and exclusions stop Defender from checking those items.
Run a Quick scan in Windows Security
- Open Start, search for Windows Security, and open the app.
- Select Virus & threat protection.
- Choose Quick scan and let the scan finish.
- If Windows reports a threat, follow the recommended action. To review detections and actions, open Protection history.
Microsoft Support describes Quick scan as an initial check and also provides deeper scan choices; its scan instructions note that “You can start a scan for malware any time you like.” A clean Quick scan does not rule out every threat. Windows Security labels can vary somewhat by Windows version.
#1 Best Overall
Choose a deeper scan if you still have concerns
If the Quick scan does not settle the issue—or if you ran the suspicious installer or program—update Defender’s security intelligence and run a Full scan. If you suspect malware is persistent or evading detection while Windows is running, use Microsoft Defender Offline as a further escalation. These options differ in scope and impact:
| Scan | What it checks | When to use it | Restart? |
|---|---|---|---|
| Quick scan | Common locations where threats are often found; it is not a check of every file. | First check after a suspicious download. | No |
| Full scan | Every file and program on the device. | Concern remains after the initial check, especially if the download was run. | No |
| Custom scan | Files or folders you select. | To target a particular location, in addition to or instead of scanning from File Explorer. | No |
| Microsoft Defender Offline | Scans outside the normal Windows environment, through Windows Recovery Environment. | Suspected persistent or evasive malware. | Yes; save open work first. |
To update security intelligence and run a Full scan, open Windows Security > Virus & threat protection. Look for the protection updates option, install available updates, then open Scan options, select Full scan, and start it. For Defender Offline, return to Scan options, select Microsoft Defender Offline scan, and start the scan. Your PC restarts to run it; afterward, check Protection history for results, including offline scan results. Exact labels may differ by Windows version. Microsoft’s unwanted-software guidance also recommends updating security intelligence, running a Full scan, and escalating to Offline scan if unwanted software persists.
Rank #2
Offline scanning is not supported on every device. Microsoft Learn lists x64 Windows 11 and x64/x86 Windows 10 among supported requirements, and says the feature does not apply to ARM Windows 10/11 or Windows Server SKUs. Check Microsoft’s current Defender Offline requirements and instructions for your device. A blank USB drive is only needed if you choose to create bootable Offline media; Microsoft’s documented media process requires at least 250 MB free and reformats the USB, erasing its existing contents. Most supported Windows users can start the scan from Windows Security without removable media.
If you ran the download, remove unwanted software and protect accounts
If the file installed an app or program, uninstall anything you do not recognize or did not intend to install, then complete the scan escalation above. Suspicious software can arrive bundled with other downloads or through compromised pages, so use official publisher sites for software in the future; Microsoft explains these routes in its malware infection overview.
A suspicious download does not automatically mean your passwords were stolen. But if you entered credentials while the program was running, or otherwise have reason to believe an account was exposed, Microsoft’s account recovery guidance says to scan and clear malware before changing that Microsoft account password. Then review connected accounts, email forwarding, and automatic replies in the account settings. See Microsoft’s compromised-account recovery steps. As a precaution, if the PC still appears compromised, change sensitive passwords from a separate device you trust.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When reinstalling Windows may be appropriate
If infection is still suspected after scanning, Microsoft lists a clean installation from Windows installation media as a recovery option. It can help remove malware from the Windows installation, but it is disruptive: the clean installation removes Windows, personal files, apps, and settings from the selected drive. Back up files you need and make sure you can reinstall applications and access important accounts before proceeding; do not restore suspicious programs or files afterward. Follow Microsoft’s Windows recovery options for current steps. If this is a work- or school-managed PC, contact your IT department instead of attempting a consumer reinstall on your own.
Quick Recap
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
