Is Your Antivirus Actually Working? 7 Quick Tests to Run Today (2026)

You paid for antivirus software, the icon sits in your system tray, and nothing has gone wrong yet. That is not the same as knowing it works. Antivirus programs quietly stop protecting you more often than people expect: a subscription lapses, a Windows update turns real-time protection off, two security programs fight each other, or the definitions stop updating because a laptop was asleep for a month. This guide gives you seven quick tests you can run in about fifteen minutes to confirm your antivirus is actually doing its job, plus what to do when a test fails.

Why “it is installed” is not enough

Modern antivirus suites have several layers: a real-time scanner that checks files as they open, a web shield that blocks dangerous downloads and phishing pages, a behavior monitor that watches for ransomware-style activity, and an update service that pulls new threat definitions several times a day. Any one of those layers can be switched off without the others complaining loudly. The tray icon usually stays green until the whole program is disabled, so a green icon tells you less than you might think.

The tests below check each layer separately. Run them in order. If you are not sure whether your license is still active, start with our guide on how to activate an antivirus license key, because an expired key disables most of what follows.

Test 1: Check the protection status screen, not the tray icon

Open the main window of your antivirus (double-click the tray icon or search for the program name in the Start menu). Every major product has a status page that lists its protection modules individually. Look for wording such as “Real-time protection: On,” “Firewall: On,” “Web protection: On,” and “Last update: today.”

• Norton 360: the home screen shows “You are protected.” Click “Device Security” to see Auto-Protect, SONAR and firewall status.
• McAfee Total Protection: open “My Protection” and check Real-Time Scanning, Firewall and Web Boost.
• Bitdefender: the Protection tab lists Antivirus, Online Threat Prevention, Advanced Threat Defense and Firewall, each with its own switch.
• Avast and AVG: open “Protection” then “Core Shields.” All four shields (File, Behavior, Web, Mail) should be on.
• Microsoft Defender: open Windows Security, then “Virus & threat protection” and “Manage settings.” Real-time protection and cloud-delivered protection should both be on.

Anything showing “Off,” “Paused” or “Attention needed” is your first fix. Programs sometimes get paused “for 15 minutes” during a game or an install and never resume.

Test 2: Run the EICAR test file

The EICAR test file is a harmless text string that every reputable antivirus is designed to detect as if it were malware. It was created by the European Institute for Computer Antivirus Research exactly for this purpose, so it is the industry-standard way to confirm real-time scanning works without touching anything dangerous.

Open Notepad and paste this single line, with nothing before or after it:

X5O!P%@AP[4\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*

Save it to your Desktop as eicar.com. A working antivirus will block or quarantine the file within a second or two, usually with a pop-up naming “EICAR-Test-File” or similar. If the file saves normally and sits on your Desktop, real-time protection is not scanning new files, and you have found a real problem.

Two notes. First, some browsers or Windows itself may block the download if you fetch the file from the web instead of typing it, which is also a pass. Second, if your antivirus only catches it when you run a manual scan but not on save, real-time scanning is off even though on-demand scanning works.

Test 3: Confirm definitions updated in the last 24 hours

Antivirus vendors push new threat signatures many times a day. A product that has not updated in a week will miss recent malware even with every switch turned on. Find the “Last update” or “Virus definitions” date on the status screen, then click “Update now” or “Check for updates” and watch it complete.

If updates fail repeatedly, the usual causes are an expired subscription, a corporate or school proxy blocking the update server, a broken installation, or a system clock set to the wrong date. Fix the clock first: Windows Settings, Time & Language, then “Sync now.”

Test 4: Test the web shield with the AMTSO safe pages

The Anti-Malware Testing Standards Organization (AMTSO) publishes a set of free security feature checks at amtso.org. They include a harmless phishing-style test page, a drive-by download test and a potentially-unwanted-application test. Each page is safe; it simply triggers the detection logic that a real attack would.

Visit the “Phishing page” and “Drive-by download” checks in your normal browser. A working web shield shows a block page from your antivirus or your browser’s safe-browsing feature. If the test page loads normally, your browser extension or web protection module is disabled, which is one of the most common gaps on machines where the user clicked “Don’t add extension” during setup.

Test 5: Run a full scan once and read the log

What a full scan actually tells you

Real-time protection only checks files as they move. A full system scan checks what is already on the disk, including files that arrived before the antivirus was installed. Run one, let it finish (it can take an hour on a large drive), then open the scan history or log. You want to see the number of files scanned, the number of threats found and what was done with them.

A scan that finishes in two minutes on a 500 GB drive with “0 files scanned” has not scanned anything. That usually means the scanner service crashed or another security program is blocking file access.

Test 6: Make sure two antivirus programs are not fighting

Running two real-time antivirus engines on one PC is one of the quickest ways to end up with neither working. Each hooks into the same file-system layer, each quarantines the other’s components, and the result is slowdowns and silent failures. On Windows, open Settings, Apps, then Installed apps, and search for “security,” “antivirus” and the names of every product you have ever tried. Leftover trial copies of McAfee or Norton that shipped with the laptop are the classic culprit.

Keep one paid product and remove the rest properly, using the vendor’s removal tool rather than only the Windows uninstaller. Our walkthrough on how to completely remove old antivirus software lists the official cleanup tools for each brand. Microsoft Defender steps aside automatically when a third-party product is active, so you do not need to remove it.

Test 7: Check that the subscription and the device are both covered

Log in to your vendor account (Norton, McAfee, Bitdefender Central, Avast Account, and so on) and look at two things: the subscription end date and the list of devices. Multi-device plans stop protecting the newest device when you exceed the seat count, and the software on that device may show a warning only once. If a device you no longer own is still using a seat, remove it from the account so your current PC is covered.

If the subscription has expired, you have two honest options: renew through the vendor, or buy a genuine retail license key and enter it in the existing installation. Retail keys are often cheaper than vendor auto-renewal pricing; see our notes on antivirus auto-renewal and how to avoid paying full price. Genuine keys for Norton, McAfee, Bitdefender, Kaspersky, Avast, AVG, ESET, Trend Micro and Malwarebytes are available in the AntivirusPoint shop with email delivery.

What to do when a test fails

1. Real-time protection off and will not turn on: restart the PC, then try again. If it still fails, run the vendor’s repair option (usually in Settings or under Help) or reinstall the product from your account page.
2. EICAR not detected: check for a second security product (Test 6), then reinstall.
3. Updates failing: confirm the subscription date, fix the system clock, temporarily disconnect from a VPN and retry.
4. Web shield not blocking: enable the vendor’s browser extension in Chrome, Edge or Firefox, and check that Safe Browsing or SmartScreen is on in the browser itself.
5. Everything looks on but the PC is behaving strangely: run a second-opinion scanner such as Malwarebytes Free or Microsoft Safety Scanner once. These are designed to run alongside your main antivirus without conflicts.

How often should you repeat these checks?

Test 1 and Test 3 take under a minute; do them monthly and after any major Windows or macOS update. Run the EICAR test and the AMTSO page checks whenever you install, renew or switch antivirus products. Run a full scan quarterly, or immediately after any suspicious email attachment or download. If you use a Mac, the same logic applies; our article on whether Macs need antivirus explains which built-in protections macOS already provides. And if you are weighing whether the paid product is worth keeping at all, is Windows Defender enough? walks through that decision.

Frequently asked questions

Is the EICAR test file safe to download?

Yes. The EICAR file contains no executable malware; it is a plain text string that antivirus vendors agree to detect as a test. It cannot damage your computer. The only effect is that your antivirus will flag or quarantine it, which is the point.

My antivirus says “protected” but my computer is slow. Is it working?

Slowness alone does not mean an infection. Run the seven tests above, then check Task Manager for programs using high CPU or disk. Two security products running at once, a scan scheduled during work hours, or a full disk are more common causes than malware.

Does Windows Defender need the same tests?

Yes. Microsoft Defender can be turned off by a third-party installer, a group policy, or a registry change made by malware. Open Windows Security and confirm real-time protection, cloud-delivered protection and tamper protection are all on, then run the EICAR test.

How do I know if my antivirus subscription is still active?

Open the program’s main window and look for “Subscription,” “My Account” or “License” in the menu; the expiry date is shown there. You can also log in to the vendor’s website, where every device and its remaining days are listed.

Can I run Malwarebytes together with Norton or McAfee?

Malwarebytes Premium can run alongside most antivirus products, and the free version is an on-demand scanner that does not conflict at all. Avoid running two full antivirus suites such as Norton and McAfee at the same time.