Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If Windows Security detects the same virus again after you restart your PC, first check the detection’s status in Windows Security > Protection history. If it is a new detection after reboot, run Microsoft Defender Offline: it restarts the PC and scans outside normal Windows, where persistent malware has less chance to hide. Save your work before starting.
Check whether it is a new detection or an old history entry
A recurring notification does not automatically prove that the threat is still active. Open Windows Security > Protection history, expand the latest relevant card, and check the threat name, affected item or path, timestamp, status, and available actions. Reviewing threat details requires administrator privileges.
Protection history covers Windows 10 and Windows 11, and keeps events for two weeks. After that, an event disappears from the list; its absence does not prove the PC was never affected. See Microsoft’s Protection History in the Windows Security App.
What each status means
- Threat found — action needed: Defender found a possible threat and is waiting for a decision. If you are unsure the item is safe, choose Quarantine. Choose Allow on device only when you are confident it is a false positive.
- Threat quarantined: The item is blocked and should not pose an immediate risk, but it may not have been deleted. Choose Remove to delete the quarantined item. Restore puts it back on the device and can trigger another alert.
- Threat blocked: Microsoft says Defender blocked and removed the threat; no further action is needed for that item. Consider how it may have arrived, such as through an unsafe email attachment, website, or infected USB device.
- Allowed threat: If you previously allowed the item and want Defender to act on it again, remove it from the Allowed threats list. Depending on the interface, the action may appear as Don’t allow.
Do not choose Allow just to stop an alert. Microsoft warns that allowing an item that is actually malicious can put personal information, data, or the device at risk.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Run Microsoft Defender Offline if the detection returns after restart
Microsoft explains that a hidden malware component can quietly reinstall a detected threat, often right after the PC restarts. For malware that keeps returning, Microsoft recommends Defender Offline. It restarts the computer and scans in Windows Recovery Environment without loading normal Windows, making it harder for malware that hides during a regular session to interfere. Details are in Microsoft’s Troubleshoot problems with detecting and removing malware.
- Save open files and work. The offline scan restarts the device.
- Open Windows Security > Virus & threat protection > Scan options.
- Select Microsoft Defender Antivirus (offline scan), then select Scan now.
- Let the PC restart and complete the scan in Windows Recovery Environment. The computer restarts again when the scan is complete.
- Return to Windows Security > Protection history and review the offline scan result and any action required.
Some Windows versions surface the scan route through Settings first. Follow the labels available on your device.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Choose the right action or scan
| Option | When to use it | What it does |
|---|---|---|
| Quarantine | A detection needs action and you are unsure whether the item is malicious. | Blocks the item; it may remain quarantined until removed. |
| Remove | The item is quarantined and you want it deleted. | Deletes the quarantined item. |
| Allow | Only when you are confident the detection is a false positive. | Lets the item run; unsafe if it is actually malicious. |
| Full scan | You want a broader scan while Windows is running. | Scans every file and program. |
| Defender Offline | The same malware returns after restart or appears able to hide while Windows runs. | Restarts into Windows Recovery Environment and scans outside normal Windows. |
Windows Security also offers Quick and Custom scans. Microsoft’s guidance for recurring malware after restart specifically points to Offline scan; a Quick scan is not a substitute when persistent malware is suspected.
Quick Recap
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
If the alert returns or the scan does not finish
- Reopen the detection card and compare its timestamp, affected item, status, and action. Do not assume that each notification means the same file is still active.
- Update Windows and Defender definitions, then follow any remediation instruction shown in the detection card. Microsoft recommends running the offline scan for recurring malware; if the detection persists, review the scan result and consider running it again.
- If Defender reports repeated scan or removal errors, use Microsoft’s troubleshooting guidance and backup advice. If cleanup still fails, contact qualified technical support and provide the threat name and relevant details.
- Do not turn off protection or download random cleaner tools. Manually deleting Defender detection-history folders is not a malware-removal method: clearing history does not establish that the threat has been removed.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
