Antivirus alerts - what to do

Summary

This guide helps you troubleshoot and resolve: Antivirus alerts - what to do. Follow the steps below to fix the issue.

Common Causes

Understanding Antivirus Alerts

What are they?

Windows Security (built into Windows 10/11) protects your computer from viruses, malware, ransomware and other threats. When it detects a risk, it displays an alert.

Types of alerts

• Virus detected – malicious software found.
• Threat blocked – dangerous activity was stopped.
• Firewall blocked an app – an app tried to access the network.
• Suspicious activity – something looks wrong.
• Ransomware protection – Windows detected ransomware behaviour.
• Controlled Folder Access alert – an app attempted to modify a protected folder.

What to Do When You See an Alert

If it says “Threat detected” or “Virus detected”

1. Do not panic. The alert may already have blocked the threat.
2. Click the alert to view details.
3. Follow the recommended action:
   • Quarantine – isolate the file (recommended).
   • Remove – delete the file completely.
   • Allow – only if you are certain the file is safe.
4. Run a full scan to ensure no further threats remain.

If Windows deletes a file

• The file was likely malicious.
• Check the Recycle Bin only if you must recover it, but be aware this can re‑introduce the threat.
• In most cases, it is safer to let Windows keep the file removed.

If a program is blocked by the firewall

1. Determine whether the program was attempting to access the internet.
2. Confirm if the program was recently installed.
3. If the program is trusted, you can allow it through the firewall.
   1. Open Settings > Privacy & security > Windows Security.
   2. Select Firewall & network protection.
   3. Choose Allow an app through firewall and adjust the settings as needed.

Ransomware or Controlled Folder Access alerts

• Read the alert details to identify the blocked app or file.
• If the app is trusted, add it to the Controlled folder access – Allowed apps list:
  1. Open Settings > Privacy & security > Windows Security.
  2. Select Virus & threat protection > Ransomware protection.
  3. Click Manage ransomware protection, then Allow an app through Controlled folder access.
• If you are unsure, keep the block in place and contact your IT support team.

Submitting a suspicious file to Microsoft for analysis

1. Open Windows Security > Virus & threat protection.
2. Click Protection history.
3. Locate the file in question and look for the Actions button.
4. Select the option to submit the sample to Microsoft and follow the on‑screen prompts.

Temporarily disabling real‑time protection for troubleshooting

1. Open Settings > Privacy & security > Windows Security.
2. Select Virus & threat protection.
3. Click Manage settings under Real‑time protection.
4. Toggle Real‑time protection to Off. Remember to turn it back On when finished.

Running a Manual Scan

Quick scan

1. Press Win + I to open Settings, then select Privacy & security.
2. Choose Windows Security > Virus & threat protection.
3. Click Quick scan.

Full scan

1. Navigate to the same location as for a quick scan.
2. Select Scan options.
3. Choose Full scan and click Scan now.
4. Allow 30–60 minutes for the scan to complete.

Windows Defender Offline scan

Use an offline scan for stubborn threats that hide while Windows is running.

1. Open Settings > Privacy & security > Windows Security.
2. Select Virus & threat protection.
3. Click Scan options.
4. Select Microsoft Defender Offline scan.
5. Click Scan now.
6. Your computer will restart and perform the scan outside of the normal Windows environment.

If You Think It’s a False Alarm

• Was the file downloaded from the internet?
• Was it attached to an email?
• If you are unsure, search the filename online.
• You can submit the file to Microsoft for analysis (see “Submitting a suspicious file to Microsoft” above).

Common False Positives

• Legitimate programmes that modify system files.
• Cracked software.
• Very old applications.
• Unusual file names.

How to View Quarantined Items

1. Open Windows Security > Virus & threat protection.
2. Click “Protection history”.
3. Review the items that were blocked or quarantined.

Best Practices

• Keep Windows Security turned on.
• Do not install two antivirus programmes simultaneously; they can conflict.
• Keep Windows updated – see How to update Windows.
• Avoid clicking suspicious links in emails.
• Download software only from trusted sources – see How to protect your PC with built‑in Windows Security features.
• If performance slows, refer to Computer running slow.

Installing a Third‑Party Antivirus

Windows Security provides comprehensive protection for most users. If you choose to install another antivirus solution, Windows Security will automatically disable its real‑time protection while the third‑party product is active; you can re‑enable Windows Security after the third‑party product is removed.

• Ensure the new antivirus is approved by your organisation – see How to manage software licences and avoid compliance issues.
• After installation, run a full scan with the new product.
• Consider using Windows Defender Offline scan for stubborn or boot‑time threats.

If Windows Security is Disabled or Missing

If Windows Security is turned off or you cannot find it in Settings, follow these steps:

• Enterprise-managed devices: If your computer is managed by your IT provider, Windows Security may be disabled by policy. Contact your IT support team before making changes.
• Standalone devices: Open Settings > Privacy & security > Windows Security. If the page is missing, your Windows installation may be corrupted or a third‑party security product may have removed it.
• Restart your computer and check again.
• If the issue persists, Open a Ticket so our team can restore your security settings.

When to Get Professional Help

• You cannot remove a threat.
• Your computer behaves unusually.
• You are unsure whether a file is safe.
• Alerts continue to appear despite following the steps above.
• Windows Security is disabled or missing and you cannot re-enable it.

If you need assistance from our support team, please Open a Ticket. Provide details about the alert, the steps you have already taken, and any error messages you have seen.

Summary

Windows Security alerts are an important part of keeping your business devices safe. Most alerts can be resolved by quarantining the threat and running a full scan. For persistent issues, use the offline scan feature or contact your IT support team for professional assistance.

Still Having Issues?