how to fix "threats"

Open Windows Security → Virus & threat protection → Protection history, inspect the newest alert’s status, detection time, threat name, and affected file path, then run Microsoft Defender Offline if the same threat is being detected again.

1. Determine whether it is active or only historical

Administrator privileges are required to see full threat details.

Expand the newest card in Protection history:

• Threat found – action needed: choose Quarantine, unless the file is unquestionably trusted.
• Threat quarantined: choose Remove. Do not choose Restore, because that returns the file to its original location.
• Threat blocked: Defender has already blocked and removed it; no further removal action is required.
• Remediation incomplete: expand the card and follow the additional action shown.

Protection History normally retains events for two weeks, so an old card does not necessarily indicate an active infection. Never select Allow on device merely to stop notifications; that permits the detected file to run. ^1^

Record these details:

• Threat name
• Detection date and time
• Status
• Affected file path

If new entries continue appearing with new detection times—especially after a restart—treat the threat as recurring rather than as a stuck notification.

2. Run the scan that operates outside Windows

Since quick/full scans, removal, and reinstalling Windows have not solved it, use Microsoft Defender Offline. It restarts into the Windows Recovery Environment, where persistent malware has more difficulty hiding or defending itself.

1. Save all open work; the computer will restart.
2. Open Windows Security.
3. Select Virus & threat protection → Scan options.
4. Select Microsoft Defender Antivirus (offline scan).
5. Select Scan now.
6. After Windows restarts, return to Windows Security → Protection history and inspect the result.

Microsoft specifically recommends this scan when the same malware returns after removal, potentially because another undetected component is reinstalling it. ^2^ The offline-scan behavior and result location are also documented here. ^3^

Also avoid reopening the download, email attachment, or website associated with the affected path; malware can be acquired again from the same source.

3. Update Defender and Windows

If the offline scan completes but the warning remains:

1. Open Windows Security → Virus & threat protection → Protection updates.
2. Select Check for updates.
3. Open Settings → Windows Update → Check for updates.
4. Install offered updates and restart.

This addresses outdated security intelligence or security components. ^4^

4. Clear a stale alert only when no new detection is occurring

If the offline scan reports no threat and Protection History shows only the same old/remediated event—not newly created detections—the alert history may be stuck.

Warning: This clears Defender’s detection history; it does not remove active malware.

1. Start Windows in Safe Mode.
2. Open File Explorer.
3. Browse to:

C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service\

4. Delete only the DetectionHistory folder.
5. Restart Windows normally.
6. Reopen Windows Security and check whether the warning is gone.

This cleanup is reported as the resolution for repeated notifications about already-remediated threats. ^5^

Do not use machine-specific Farbar/FRST “fixlist” scripts found in other support threads. Such scripts are written for the logs and configuration of one particular computer and should not be reused elsewhere. ^6^

If fresh detections continue

Run the Microsoft Safety Scanner as an additional Microsoft scan. Microsoft recommends it when a computer may still be infected. ^7^

If it still recurs, provide the threat name, status, detection time, and affected path from Protection History. Those details are necessary to determine whether a startup item or another source is recreating the file.

References

1. Protection History in the Windows Security App | Microsoft Support
2. Troubleshoot problems with detecting and removing malware | Microsoft Support
3. Virus and Threat Protection in the Windows Security App | Microsoft Support
4. Defender "action recommended" - Microsoft Q&A
5. A trojan defender will not remove - Microsoft Q&A
6. My Windows Security shows a list of Threats that I can't remove, or fix. - Microsoft Q&A
7. Microsoft resources and guidance for removal of malware and viruses | Microsoft Support