If Windows Security detects the same malware again after a restart, first check the detection’s status in Windows Security > Protection history. If it is a recurring infection, Microsoft recommends a Microsoft Defender Offline scan, which restarts the PC and scans outside normal Windows. Save open work before you start.
Check what Windows Security actually detected
A notification or repeated-looking history entry does not, by itself, prove that the threat is still active. Open Windows Security > Protection history, expand the latest relevant card, and note the threat name, affected item or path, timestamp, status, and available actions. You need administrator privileges to review threat details.
As an Amazon Associate I earn from qualifying purchases.
Protection history is available in Windows 10 and Windows 11, but it keeps events for only two weeks. An older event disappearing from the list is not evidence that the device was never affected. Microsoft explains Protection history and its retention period.
Choose an action based on the status
- Threat found — action needed: Defender found a possible threat and needs a decision. If you are unsure whether the item is safe, choose Quarantine. Consider Allow on device only when you are confident the detection is a false positive.
- Threat quarantined: The item is blocked and should not pose an immediate risk, but it has not necessarily been deleted. Choose Remove to delete the quarantined item. Restore puts it back on the device and may trigger another alert.
- Threat blocked: Microsoft says Defender blocked and removed the threat, so no further action is needed for that item. Consider how it may have arrived, such as in an unsafe email attachment, from a website, or through an infected USB device.
- Allowed threat: To have Defender act on an item you previously allowed, remove it from the Allowed threats list. Depending on the interface, the action may appear as Don’t allow.
Do not use Allow just to make an alert disappear. Microsoft warns that allowing an actual threat can put personal information, data, or the device at risk. Likewise, do not restore a quarantined file simply to clear a notification.
#1 Best Overall
Run Microsoft Defender Offline for a detection that returns after reboot
A threat that reappears after restarting may be getting reinstalled by a hidden component. Microsoft describes this as one cause of recurring detections and recommends Windows Defender Offline when the same malware keeps returning. Microsoft’s malware-removal troubleshooting guidance explains the recurring-detection scenario.
Unlike a scan during a normal Windows session, Defender Offline restarts the device and scans in Windows Recovery Environment. Because normal Windows is not loaded, malware that hides or interferes while Windows is running may have less opportunity to do so. Microsoft documents the scan options and results in its Microsoft Defender Offline overview.
- Save open files and work. The scan restarts the PC, runs outside normal Windows, and the device restarts again when it finishes.
- Open Windows Security > Virus & threat protection > Scan options.
- Select Microsoft Defender Antivirus (offline scan), then choose Scan now. On some Windows versions, you may reach the scan options through Settings first.
- After Windows starts again, open Windows Security > Protection history and review the offline scan result and any remediation instructions.
Microsoft lists Quick, Full, Custom, and Offline scans. A Full scan checks every file and program, but a regular in-Windows scan is not the same escalation Microsoft recommends when the same malware returns after restart. Microsoft does not give a standard duration for the offline scan, so allow time for the restart and scan to finish.
Free tools Windows power users keep installed
One-click scans. No signup required.
If the detection comes back or the scan fails
Check the new Protection history card rather than assuming a notification refers to the same active file. Compare its threat name, affected item, timestamp, and status with the earlier entry. Follow any remediation instructions shown for the detection.
Rank #3
- Update Windows and Microsoft Defender security intelligence, then rerun the offline scan if the detection recurs.
- If Defender reports scan or removal errors, follow Microsoft’s troubleshooting guidance and its advice on backups.
- If cleanup still fails, seek qualified technical support and provide the detection name and relevant details. Avoid random cleanup utilities and do not turn off protection as a workaround.
Deleting protected Defender history folders is not a malware-removal step: clearing a record does not establish that the threat has been removed. If an offline scan does not resolve the problem, the detection details and device configuration are needed to diagnose what is happening; one scan cannot guarantee cleanup in every case.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
