Using The M.D.A. On It's Own?

If the PC has run known-dangerous software or suffered damage, stop testing downloads, disconnect it from the network, run Microsoft Defender Offline, and reset or reinstall Windows if damage or infection remains.

Microsoft Defender Antivirus (MDA) allowing confirmed malware to execute while it is the active, fully configured antivirus is not the intended result. However, one antivirus detecting a file that another misses does not alone prove that the file is malware: detection engines and potentially unwanted application classifications differ. The Defender records and status must be checked to distinguish a missed detection from an allowed threat, incomplete remediation, disabled protection, or stale security intelligence.

Clean the affected PC first

1. Disconnect the PC from the Internet and other devices.
2. Save essential personal documents only. Do not back up downloaded installers, scripts, cracks, or executables from the affected period.
3. Open Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now.
   • Save open work first because the computer restarts.
   • The scan runs in the Windows Recovery Environment, where persistent malware has more difficulty hiding or defending itself.
   • After Windows restarts, open Windows Security → Protection history to review the result. ^1^
4. Run the Microsoft Safety Scanner as an additional on-demand scan. Microsoft recommends it when infection is suspected; on-demand scanners can coexist with the installed real-time antivirus. ^2^
5. If malware caused irreversible changes, reset or reinstall Windows. Restore files only from a backup created before the infection and stored externally; a backup connected during the infection might also have been modified. ^3^

Change important passwords from a separate, known-clean device if credentials may have been exposed.

Determine what Defender actually did

Open Windows Security → Virus & threat protection → Protection history, expand each relevant event, and read its status:

• Threat blocked: Defender blocked and removed it.
• Threat quarantined: It was neutralized but still needs Remove if permanent deletion is wanted.
• Threat found – action needed: Select Actions → Quarantine.
• Remediation incomplete: Defender attempted cleanup but could not finish it; expand the card for the required action.
• Allowed threat: Defender will not act against that item until permission is revoked. Go to Virus & threat protection → Allowed threats, select it, and choose Don’t allow. ^4^

Protection History retains events for only two weeks, and administrator privileges are required to view threat details. A restart request does not by itself prove removal succeeded; the resulting event must say Threat blocked, or the item must otherwise be absent after a new scan.

Verify Defender was actively protecting the PC

Open PowerShell as administrator and run:

Get-MpComputerStatus | Select-Object `
  AMRunningMode, AntivirusEnabled, RealTimeProtectionEnabled, `
  BehaviorMonitorEnabled, AntivirusSignatureVersion

Update-MpSignature

Interpret AMRunningMode as follows:

• Normal — Defender is the active antivirus.
• Passive — Defender is not the primary antivirus and normally does not provide Defender antivirus remediation.
• EDR Block Mode — enterprise Defender for Endpoint behavior.

Defender’s official protection states are active, passive/EDR block, and disabled; only active mode makes it the primary antivirus that scans and remediates threats. ^5^

Also check Windows Security → Virus & threat protection → Manage settings and ensure these are on:

• Real-time protection
• Cloud-delivered protection
• Automatic sample submission
• Tamper protection

Real-time protection scans files as they are accessed or executed; cloud-delivered protection improves identification and remediation; tamper protection helps prevent malicious apps from changing critical Defender settings. Review Exclusions as well—excluded files, folders, file types, or processes are not checked normally. ^1^

About using one antivirus

Use only one real-time antivirus. On Windows 10/11, installing a compatible non-Microsoft antivirus normally causes Defender to disable itself or stop being the primary antivirus. Running multiple real-time products can reduce performance or cause instability, but an on-demand scanner such as Microsoft Safety Scanner is suitable for a second opinion. ^6^

No antivirus guarantees detection of every malicious or newly modified file. Do not deliberately install dangerous downloads on a normal PC to evaluate protection; use an isolated disposable virtual machine or a purpose-built security test environment instead.

References

1. Virus and Threat Protection in the Windows Security App | Microsoft Support
2. Microsoft resources and guidance for removal of malware and viruses | Microsoft Support
3. Troubleshoot problems with detecting and removing malware | Microsoft Support
4. Protection History in the Windows Security App | Microsoft Support
5. Microsoft Defender Antivirus compatibility with other security products
6. Antivirus and antimalware software: FAQ | Microsoft Support