What a malware scanner does and why you need one

A malware scanner is a program that searches your computer's files, programs, and memory for code that behaves like malware — viruses, trojans, ransomware, spyware, and other threats. It compares what it finds against a database of known malicious signatures and suspicious behaviors, then reports what it discovered and lets you remove or quarantine the threats.

Most modern operating systems include a built-in scanner: Windows Defender on Windows, and Xprotect on macOS. These work passively in the background and catch most common threats. A separate malware scanner is useful when you suspect an infection, want a second opinion, or need more aggressive scanning options than your built-in protection offers.

The difference between a scanner and antivirus software matters. A scanner runs on demand — you start it, it searches, it reports. Antivirus software runs continuously, blocking threats before they land. Many people use both: antivirus as the first line of defense and a scanner as a backup when something feels wrong.

Key Takeaways

  • Windows Defender and macOS Xprotect are free and built into your operating system, so you already have a malware scanner running.
  • Standalone scanners like Malwarebytes, Norton Power Eraser, and Kaspersky Rescue Disk are useful when you suspect an infection or want a second opinion.
  • Some scanners run from a USB drive or boot disk, which can find threats that hide from your normal operating system.
  • Free scanners work for one-time checks; paid versions add real-time monitoring and automatic updates.
  • Running multiple scanners at once can slow your computer and cause false positives — use them one at a time.

Built-in scanners that come with your operating system

Windows Defender (called Windows Security in Windows 10 and later) scans your computer continuously and runs full scans on a schedule you set. Open it by typing "Windows Security" into your search bar. It is free, requires no installation, and catches the majority of common threats. To run a full scan manually, click "Virus & threat protection," then "Scan options," then select "Full scan" and click "Scan now." A full scan typically takes 30 minutes to several hours depending on how many files you have.

macOS Xprotect runs automatically in the background on every Mac. You cannot open it directly — it works silently. If it detects malware, it will notify you and ask what to do. Xprotect is less visible than Windows Defender but is considered effective for common threats on Mac.

Both built-in scanners update automatically through your operating system updates. They are designed to catch known threats quickly without slowing your computer down. If you suspect an infection and your built-in scanner finds nothing, a standalone scanner may catch what the built-in one missed.

Standalone scanners for suspected infections

Malwarebytes is one of the most widely used standalone scanners. The free version runs on demand and scans your computer for malware. Download it from malwarebytes.com, install it, open it, and click "Scan." It typically finds threats that Windows Defender misses, particularly potentially unwanted programs (PUPs) like browser toolbars and adware. The paid version adds real-time protection and automatic scanning. Malwarebytes works on Windows, Mac, and Android.

Norton Power Eraser is a free tool from Norton that specializes in removing stubborn malware. It is lighter weight than a full antivirus suite and focuses on threats already on your computer. Download it from norton.com, run it, and let it scan. It works on Windows only.

Kaspersky Rescue Disk is a bootable scanner — you download it, write it to a USB drive, restart your computer, and boot from the USB. This approach scans your computer before Windows or macOS loads, which can find threats that hide from your normal operating system. It is free and works on Windows. The process takes longer than a normal scan but is more thorough for serious infections.

Avast One Essential and AVG Antivirus Free are full-featured free scanners that run on demand or continuously. Both are available for Windows and Mac. They scan for viruses, malware, and PUPs. The free versions include basic scanning; paid versions add real-time protection.

How to run a malware scan safely

Before you scan, close all open programs and browser windows. Malware can hide in running processes, and closing everything gives the scanner a clearer view. Disable any VPN or proxy you are using — some scanners have trouble working through them. Make sure your computer is plugged in if it is a laptop; a scan can take hours and you do not want the battery to die halfway through.

Download the scanner directly from the publisher's website, not from a third-party download site. Malware often disguises itself as a legitimate scanner, so going to the official source matters. If you are not sure whether a website is official, search "[program name] official download" to confirm.

Run the scan in Safe Mode if you suspect a serious infection. Safe Mode loads only essential Windows files and drivers, which prevents malware from interfering with the scan. On Windows 10 and later, restart your computer, press F8 or Shift+F8 during startup, and select "Safe Mode with Networking." On Mac, restart and hold Shift until you see the login screen.

Do not run multiple scanners at the same time. They can interfere with each other, slow your computer to a crawl, and produce false positives (flagging safe files as threats). Run one scanner, let it finish, restart your computer, then run the next one if needed.

What to do when a scanner finds threats

When a scanner detects malware, it will show you a list of what it found and ask what you want to do. Most scanners offer three options: remove (delete the file), quarantine (move it to an isolated folder where it cannot run), or ignore. Choose "remove" or "quarantine" for anything the scanner flags as malware. Quarantine is safer if you are not certain — you can restore the file later if it was a false positive.

Some malware cannot be removed while Windows is running because the operating system is using the infected file. The scanner will ask to remove it on the next restart. Let it do that — restart your computer and let the removal happen before Windows fully loads.

After removal, run the scan again to confirm the threats are gone. If the same malware appears after removal, the infection may be deeper than a scanner can handle. At that point, consider a professional repair service or a clean Windows reinstall.

Free versus paid malware scanners

Free scanners run on demand — you start them manually whenever you want to check your computer. They work well for one-time scans and for people who already have antivirus software running in the background. Malwarebytes Free, Norton Power Eraser, and Kaspersky Rescue Disk are all effective free options.

Paid scanners add real-time monitoring, which means they watch your computer continuously and block threats before they land. They also include automatic updates, priority support, and sometimes additional tools like a firewall or password manager. Malwarebytes Premium, Norton 360, and Kaspersky Internet Security are paid options. Most cost between $30 and $100 per year.

For most people, a free built-in scanner (Windows Defender or macOS Xprotect) plus a free standalone scanner (Malwarebytes Free) when you suspect trouble is enough. Pay for a full antivirus suite only if you download files frequently, visit risky websites, or want the peace of mind of continuous monitoring.

Scanners for specific situations

If your computer will not start normally, a bootable scanner is your best option. Kaspersky Rescue Disk, Avast Rescue Disk, and Bitdefender Rescue Disk all work the same way: download the image file, write it to a USB drive using a tool like Rufus (Windows) or Etcher (Mac), restart your computer, and boot from the USB. These scanners run before your operating system loads, so they can find threats that hide from normal scans.

If you think malware is stealing your passwords or banking information, run a scan in Safe Mode, then change your passwords from a different device (like a phone or tablet) while the infected computer is offline. Do not change passwords on the infected computer itself.

If you are cleaning up a computer for someone else, run a scan, remove what you find, then run Windows Update or macOS Software Update to patch security holes the malware may have used to get in. Malware often exploits outdated software.

Frequently Asked Questions

Is Windows Defender enough, or do I need a separate malware scanner?

Windows Defender catches most common threats and is sufficient for most people. A separate scanner like Malwarebytes is useful if you suspect an infection, download files frequently, or want a second opinion. Many people use both: Windows Defender running continuously and Malwarebytes for occasional checks.

Can malware hide from a malware scanner?

Yes. Some malware is designed to evade detection by hiding in system files, using encryption, or modifying itself. Bootable scanners like Kaspersky Rescue Disk can find threats that hide from normal scans because they run before your operating system loads. If a standard scan finds nothing but you still suspect infection, try a bootable scanner.

Why does my scanner say a file is malware when I know it is safe?

This is a false positive. Scanners sometimes flag legitimate programs as threats, especially if the program is new, obscure, or behaves in ways that resemble malware. If you trust the file, you can tell the scanner to ignore it. If you are unsure, search the filename online or check the publisher's website before removing it.

How often should I run a malware scan?

If you have real-time antivirus running (like Windows Defender or a paid antivirus suite), you do not need to scan manually. If you use only a free on-demand scanner, run it monthly or whenever you download files from untrusted sources. If you suspect an infection, scan immediately.

What is the difference between a virus and malware?

A virus is a type of malware that spreads by attaching itself to other files. Malware is the broader category that includes viruses, trojans, ransomware, spyware, and other harmful code. Malware scanners detect all of these, not just viruses.