If you downloaded a suspicious file, don’t open it again. Scan the file in File Explorer, then run a scan in Windows Security. If you ran the file or your concern remains, update Microsoft Defender’s security intelligence and move to a Full scan or Microsoft Defender Offline. A clean scan is reassuring, but it cannot prove that a PC is infection-free.
First, don’t open the download again
Do not run the file, open it, or try to inspect it by launching it. If it was only downloaded and never opened, locate it in File Explorer, right-click it, and choose Scan with Microsoft Defender. In Windows 11, you may need to select Show more options first. Microsoft documents this targeted scan in its Windows Security guidance.
If Defender flags the file, follow the recommended quarantine or removal action. Don’t disable real-time protection or create an exclusion to make the file easier to access: files opened or downloaded while real-time protection is off are not scanned in real time, and excluded items are not checked by Defender.
Run a Quick scan in Windows Security
- Open Windows Security. Depending on your Windows version, you can also reach the security dashboard through Microsoft Defender.
- Select Virus & threat protection.
- Choose Quick scan and let it finish.
- If Windows reports a threat, follow its recommended action. To check the record of detections and actions, open Protection history.
Microsoft Support says, “You can start a scan for malware any time you like.” A Quick scan is a useful first check, not a guarantee that every threat has been found. The names and placement of controls can vary by Windows version.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problems#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Choose the right scan if concern remains
Windows Security offers scans with different scopes. A broader or offline scan can be a sensible escalation, but no scan type guarantees detection of every threat.
| Scan | Scope | When to use it | Restart |
|---|---|---|---|
| Quick scan | Initial check of common locations | First response after finding a suspicious download | No |
| Full scan | Checks every file and program on the device | Concern remains after the initial check, or unwanted software was installed | No |
| Custom scan | Checks a selected file or folder | You want to target a particular location | No |
| Microsoft Defender Offline | Scans outside the normal Windows environment | You suspect a persistent or evasive threat | Yes; the PC restarts |
Update Defender and run a Full scan
If the Quick scan does not resolve your concern, update security intelligence in Windows Security, then choose Full scan under Virus & threat protection scan options. A Full scan checks every file and program; allow it time to complete.
Rank #2
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Use Microsoft Defender Offline for a suspected persistent threat
Microsoft Defender Offline restarts the PC and scans in the Windows Recovery Environment, outside the normal Windows kernel. That makes it an escalation option when you suspect malware could be hiding or persisting while Windows is running. Save open work before starting it, then use Windows Security > Virus & threat protection > Scan options > Microsoft Defender Offline scan and start the scan. Review Protection history afterward for its results.
Microsoft Learn lists support for x64 Windows 11 and x64/x86 Windows 10, and says the feature does not apply to ARM Windows 10/11 or Windows Server SKUs. Check Microsoft’s current Defender Offline requirements for device compatibility. The same documentation warns that a BitLocker-protected device may request its recovery key after restart.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Optional: create bootable Offline media
Most supported Windows users can start Offline Scan from Windows Security; a USB drive is not required for the usual workflow. Microsoft also documents creating bootable Defender Offline media on a blank CD, DVD, or USB with at least 250 MB free. The USB is reformatted during creation, erasing its existing data, so use media with nothing you need to keep. See Microsoft’s media-creation instructions and requirements.
If you ran or installed the suspicious file
Running the download changes the situation: treat the PC as potentially exposed, even if you have not noticed symptoms. Use the scan escalation steps above, and remove software you do not recognize or did not intend to install. Microsoft recommends uninstalling unwanted software, updating security intelligence, and running a Full scan; if unwanted software persists, use Defender Offline. Keep Windows and your applications updated, and get future downloads from the publisher’s official site. Microsoft describes how bundled software and compromised web pages can lead to unwanted downloads in its guide to ways malware can infect a PC.
Rank #4
- Security Key : Protect your online accounts against unauthorized access by using FIDO2 and U2F authentication with T110. It's the world's most protective security key that works with windows, Mac OS, Linux as well as Chrome, Firefox, Edge and many other major browsers.
- Certified with the new FIDO2 standard, T110 provides the benefit of fast login and strong protection against phishing, account takeover as well as many other online attactks.
- Works with : Bank of America, Github, Google, Microsoft, DUO, Twitter, Facebook, Dropbox, Apple, ebay, BINANCE, mor and more.
- Fits USB-A port : Insert the T110 security key into the USB-A port of each service and log in conveniently with one touch
- For the driver download and user guide, please visit TrustKey Solutions Home support page.
Protect accounts if credentials may have been exposed
A suspicious download does not by itself mean your passwords were stolen. If you have reason to think a Microsoft account was compromised, Microsoft’s recommended order is to scan and clear malware before changing that account’s password. Once the PC is clear of detected malware, change the password and review connected accounts, email forwarding, and automatic replies using Microsoft’s account recovery guidance.
If the PC still appears compromised, a prudent precaution is to make sensitive password changes from a different device you trust to be clean.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- Ultra-Compact FIDO2 Security Key - Plug-and-stay or carry on a keychain. This USB-A hardware security key offers portable, always-on protection for desktop and mobile use. (Item Size: 0.75 X 0.74 IN x 0.25 IN)
- USB-A Hardware Key for All Devices - Works with USB-A ports on PC, Mac, Android, and other laptop/notebook device. Enables secure, cross-platform login with FIDO2.0 passkey support.
- FIDO Certified Security Key - Meets FIDO and FIDO2 standards. Works with Google, Microsoft, GitHub, Dropbox, and more. Please check service compatibility before purchase.
- Passwordless Login with Passkey - Supports passkey login via WebAuthn and CTAP2. Enjoy password-free sign-ins where supported. Not all websites or services currently support passkeys.
- Advanced Multi-Factor Authentication - Offers 200 FIDO2 passkey slots and 50 OATH-TOTP slots. Strong, flexible 2FA/MFA support across various apps and authentication platforms.
When to consider reinstalling Windows
If you suspect infection remains despite scans and cleanup, Microsoft lists a clean installation from Windows installation media as a recovery option. It removes Windows, personal files, apps, and settings from the selected drive. Back up files you need before proceeding, but avoid carrying suspicious programs or files into the recovered system. Review Microsoft’s Windows recovery options and installation instructions before starting, because this is a disruptive step rather than a routine first scan. If the PC is managed by work or school, contact your IT department instead of applying consumer recovery steps on your own.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
