Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

A webcam light or unexpected camera activity is a reason to investigate, not proof that your computer has malware. First avoid suspicious pop-ups or calls, then scan with a trusted security tool. On Windows, Windows Security offers quick, full, custom, and offline scans; after checking for threats, review which apps can access the camera and secure the device with updates and backups.

Could unusual webcam activity mean malware?

It could, but the camera indicator alone cannot tell you why the camera is active. A legitimate video-call app, browser tab, or camera setting may explain it; malware is another possibility. Slow performance, crashes, pop-ups, redirects, or unfamiliar toolbars can also be warning signs, but none diagnoses malware by itself. Microsoft recommends treating camera indicators as a reason to check app activity and scan for harmful software: Microsoft webcam and camera-permission guidance. The FTC also describes possible malware symptoms and warns about fraudulent support pitches: FTC: How to recognize, remove, and avoid malware.

What should you do first?

  1. Stop interacting with suspicious prompts. Do not call a number in a pop-up, install a tool prompted by an unsolicited message, or pay someone who claims an unexpected scan found malware. The FTC warns that unexpected calls and messages can be used to sell unnecessary or fraudulent security software: FTC malware guidance.
  2. Use a security tool you already trust. On Windows 10 or 11, open Windows Security and run a scan. Do not rely on a pop-up’s claims about what it found.
  3. Save open work before any scan that restarts the computer. An offline scan will reboot the PC.

How do you scan a Windows PC for malware?

Windows Security includes several scan types. Use a quick scan as an initial check; if concern remains, choose a full scan, a custom scan of selected locations, or an offline scan for persistent concerns. Microsoft documents these options and where to review results in Windows Security.

Scan What it does When to choose it
Quick scan Checks common locations where threats are found. A sensible first scan; it is less comprehensive than a full scan.
Full scan Checks every file and program on the device. Choose this if a quick scan does not resolve your concern and you want a broader check.
Custom scan Scans files or folders you select. Useful when you want to check a particular location, such as a downloaded file or removable drive.
Microsoft Defender Antivirus (offline scan) Restarts the PC and scans in Windows Recovery Environment, outside the normal Windows session. Use for persistent or potentially evasive threats that may hide while Windows is running.

Run a quick, full, or custom scan

  1. Open Windows Security from the Start menu.
  2. Select Virus & threat protection, then Quick scan. To choose another scan, select Scan options, select the scan type, then choose Scan now. For a custom scan, select the locations you want checked when prompted.
  3. When the scan finishes, follow Windows Security’s instructions for any detected threat. If the concern continues, run a full or custom scan.

Run Microsoft Defender Offline

  1. Save open work and close files you do not want to lose; the scan restarts the computer.
  2. In Windows Security, go to Virus & threat protection > Scan options > Microsoft Defender Antivirus (offline scan) > Scan now.
  3. After the restart and scan, open Windows Security > Virus & threat protection > Protection history to review the result.

The offline scan runs outside the regular Windows session, which can help when threats try to hide from the operating system. Microsoft says: “Microsoft Defender Offline runs outside of Windows to remove rootkits and other threats that hide from the Windows operating system.” See Microsoft Defender Offline guidance.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

What if the threat returns or cannot be removed?

If the same malware reappears, Microsoft recommends restarting and scanning before opening other applications, and suggests Windows Defender Offline for recurring infections: Microsoft troubleshooting guidance. If your scan cannot resolve the problem, or the computer contains work or sensitive information, contact a trusted technician or your organization’s IT team. Avoid deleting system files based on a generic online checklist; removing the wrong file can damage Windows or installed software.

How do you limit which apps can use the camera?

After scanning, review camera permissions for the operating system, browser, and video-calling apps. Turn off access for apps that do not need it, and close browser tabs or calling apps when you are finished. On Windows, open Settings > Privacy & security > Camera to review camera access and app permissions. Labels can differ by Windows version. Microsoft explains camera permissions and the indicator in its camera guidance. On macOS or another operating system, use the platform maker’s current camera-privacy settings; the Windows menu path does not apply.

Remove software you do not recognize or no longer use, using the operating system’s normal uninstall process rather than deleting program files by hand. CISA recommends evaluating software settings and removing unused programs: CISA: Secure Our World.

How do you reduce the chance of another infection?

  • Install operating-system and application updates. Updates can address security weaknesses. CISA recommends keeping software patched and antivirus protections maintained: CISA software-update guidance.
  • Keep antivirus protection current. Use Windows Security or the current security protections provided for your operating system; keep them enabled and updated.
  • Keep a separate backup of important files. CISA recommends backing up to an external hard drive or a properly vetted cloud service: CISA backup guidance. A backup protects your files for recovery; it does not detect or remove malware.

An external hard drive is one option for a separate copy of important files. Choose a backup method you can maintain and keep the backup disconnected when it is not in use, if practical. Do not treat buying a drive as a malware-removal step.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

What should you do if you use a Mac or another operating system?

The scan paths above are specifically for Windows 10 and 11. For macOS or another platform, check the manufacturer’s current documentation for its built-in security scanning and camera privacy controls rather than applying Windows instructions. The steps that carry across platforms are to avoid unsolicited cleanup pitches, use a trusted security tool, revoke camera access from apps that do not need it, install updates, remove unwanted software, and maintain a separate backup.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.