How to Run a Malwarebytes Scan on Windows
To scan a Windows PC, open the application, start the default scan from the dashboard, and leave it alone until it finishes. A default scan checks memory, startup items, the registry and the locations malware normally uses; a custom scan lets you point it at specific drives or folders.
The part people get wrong is not starting the scan — it is reading the results. Most of this guide is about what the detections mean and what to do next.
How Malwarebytes scans Windows
The scanner works through several stages: it checks running processes and loaded modules in memory, then startup and scheduled-task entries, then registry keys commonly used for persistence, then files on disk. Each object is judged by signature matching, structural heuristics and behavior rules.
That order matters, because active malware is caught in memory before its files are examined — which is why a scan can report a threat that no longer exists on disk after a reboot.
How to start a malware scan
- Close browsers and any program you were troubleshooting.
- Open the application from the Start menu or the notification area.
- Start the default scan from the dashboard.
- For a specific folder, external drive or a single suspicious download, choose the custom scan option instead.
- Let it run to completion — interrupting it leaves detections unreviewed.
- Review the list, quarantine what you accept, then restart if prompted.
Button and menu labels move between versions, so match the intent rather than the exact wording you see in an old screenshot elsewhere.
Quick scan vs more thorough scanning
The default scan is fast because it targets where malware actually lives. A full sweep of every file on every drive takes far longer and, for most infections, finds nothing extra. Use the thorough option when a default scan came back clean but the PC still misbehaves, or when you are checking a drive from another machine.
| Scan type | Typical use | Time |
|---|---|---|
| Default scan | Routine check, suspected infection | Minutes |
| Custom or full scan | Clean result but ongoing symptoms, external drives | Much longer |
| Rootkit scanning enabled | Persistent detections that return after reboot | Longer than default |
What Malwarebytes scan results mean
Detection names carry information. A prefix such as Trojan, Spyware or Ransom describes the family; PUP or PUM marks a potentially unwanted program or system modification, which is often software you installed on purpose. Generic or heuristic names mean the engine judged behavior rather than matching a known sample, so those are the ones worth a second look before removal.
Check the file path alongside the name. A hit inside a downloads folder is straightforward; a hit on a file inside a program you rely on deserves a search on the detection name first.
What to do when malware is detected
- Quarantine everything you do not recognise.
- Leave anything you deliberately installed selected only if you are willing to lose it — a flagged crack or keygen is genuinely risky, not a false positive.
- Restart the PC when asked.
- Run one more scan to confirm the result is clean.
- If detections keep returning, follow the removal guide or reinstall Windows.
If the hit was a trojan or a credential stealer, change important passwords from a different device — see the trojan guide.
Quarantine and detection results
Quarantine is a holding area, not a deletion. Files there are neutralised and cannot execute, and you can restore one if a program you need stopped working right after the scan. Once you are confident the PC is stable, clearing quarantine frees the space.
Scan reports are kept in the application's history, which is useful evidence when the same detection appears every few days: a recurring hit usually means a persistence mechanism is still in place.
Malwarebytes scan troubleshooting
- Scan will not start: restart Windows, then start the application before opening anything else — some malware blocks security tools once a session is established.
- Scan stops partway: check free disk space and disable sleep while scanning.
- Scan runs extremely slowly: another resident scanner may be inspecting every file the scan touches; a default scan instead of a full sweep usually resolves it.
- Same detection returns after every reboot: enable rootkit scanning, then check scheduled tasks and startup entries.
- Detections you believe are wrong: restore from quarantine and report it via our false positive page.
Frequently asked questions
How often should I scan?
Weekly is plenty for a well-maintained PC with resident protection running. Scan immediately after any unexpected browser change or unknown installer.
Can I use the PC while it scans?
Light use is fine, but close browsers and heavy applications so processes are not started and stopped mid-scan.
Does scanning slow Windows down?
Temporarily, yes — a scan reads a lot of files. Performance returns to normal when it finishes.
Is a clean scan proof the PC is safe?
No. It means this engine found nothing at this moment. Pair it with the resident protection in Windows and keep the system patched.
Malware-Bytes.net is an independent information resource about malware protection for Windows. We are not Malwarebytes, and this site is not the official Malwarebytes website or support channel. Malwarebytes is a trademark of Malwarebytes Inc.