Trojan Scanner for Windows
To scan Windows for trojans you need an on-demand scanner and, ideally, a second engine for confirmation: run a full scan with Windows Security, then a full scan with an independent anti-malware scanner such as Malwarebytes, and compare what each one reports.
Trojans hide by looking legitimate, so detection is partly a scanning job and partly a matter of noticing behavior that does not fit. This guide covers both.
What is a trojan?
A trojan is malware that arrives disguised as something you wanted — a cracked game, a codec pack, an invoice attachment, a fake driver updater. Unlike a virus it does not spread by infecting other files; it relies on a person choosing to run it.
Once it runs, its payload can be almost anything: a backdoor for remote access, a keylogger, a credential stealer, a downloader that installs further malware, or a loader for ransomware. See malware vs virus for where trojans sit in the wider family.
How to scan Windows for trojans
- Disconnect from the network if you suspect an active backdoor or a credential stealer.
- Open Windows Security, go to Virus & threat protection, and run a full scan rather than a quick scan.
- If that finds nothing but the symptoms persist, run the Microsoft Defender offline scan, which restarts the PC and scans before Windows loads.
- Install a second on-demand scanner and run a full scan with it as an independent opinion.
- Quarantine everything both tools flag, restart, then scan again to confirm the machine comes up clean.
- Change passwords for important accounts from a different, known-clean device.
The step-by-step walkthrough in our Malwarebytes scan guide covers the second-opinion part in detail.
Can Malwarebytes detect trojans?
Trojans are among the categories its Windows scanner is built for, and signature plus behavior detection catches a large share of the families in circulation. No scanner catches everything, though — a freshly compiled sample, a heavily obfuscated loader or a trojan already running with kernel privileges can evade any single product.
That is the honest framing: a scanner meaningfully improves your odds, and no product on the market can guarantee that a PC is free of trojans.
Trojan scanner vs Windows Security
Windows Security is a resident antivirus with its own trojan definitions, always running, tightly integrated with the operating system. An additional on-demand scanner is not a replacement — it is a different engine with different heuristics, which is exactly why running both is useful when something already looks wrong.
Details of that overlap are in Malwarebytes vs Windows Security.
Signs your PC may have a trojan
- Unfamiliar processes using CPU or network bandwidth while the PC is idle
- The browser homepage or search engine changes back after you fix it
- Security tools or Windows Update refuse to start or silently fail
- New scheduled tasks, services or startup entries you did not create
- Friends receive messages from your accounts that you did not send
- Sudden certificate or antivirus warnings on sites that normally load fine
None of these on its own proves an infection — a failing drive and a badly written driver produce similar symptoms. Two or three together justify a full scan.
What to do if a trojan is detected
Do not panic-delete first. Read the detection name and the file path: knowing whether the hit is in a downloads folder, in a browser extension or inside a Windows system directory determines what happens next.
- Let the scanner quarantine the file rather than deleting it immediately.
- Restart the PC and rescan, because some components only reappear after a reboot.
- Check installed programs, browser extensions and startup entries for anything added around the same date.
- Change passwords from a clean device, starting with email and banking.
- Enable two-factor authentication on any account that supports it.
How to remove a trojan from Windows
Most consumer trojans come off with a quarantine, a reboot and a clean rescan. Some do not: if scans keep finding the same component, if the scanner cannot start, or if system files were modified, a clean reinstall of Windows is faster and more trustworthy than an open-ended cleanup.
Our malware removal guide covers the longer cleanup path, including what to do when the scanner itself is being blocked.
Frequently asked questions
Is there a free trojan scanner for Windows?
Yes. Windows Security is built in and free, and the free Malwarebytes tier provides on-demand scanning as a second opinion.
Can a trojan survive a scan?
It can. Rootkit-style components and samples too new for the definitions can be missed, which is why a reboot-and-rescan and a second engine are worth the extra time.
Does a factory reset remove a trojan?
A clean Windows reinstall removes almost all of them. Restoring an infected backup afterwards can bring the trojan straight back, so scan restored data separately.
Are trojan warnings from browser pop-ups real?
Almost never. A web page cannot scan your PC; those alerts are scareware designed to make you install something. Close the tab and scan with a tool you installed yourself.
Malware-Bytes.net is an independent information resource about malware protection for Windows. We are not Malwarebytes, and this site is not the official Malwarebytes website or support channel. Malwarebytes is a trademark of Malwarebytes Inc.