Windows Security Keeps Saying Threats Found

If Windows Security keeps saying threats found, check the source first: stale Defender history, an active infection, or a fake browser alert are the three common causes. Ignore the source and you may keep deleting harmless entries while missing the real threat or letting a notification loop continue. Start in Windows Security > Protection History and read the detection name, affected path, and action status.

What the popup usually means

The popup means Windows Security has a detection record, not always a live file. Protection History shows the detection name, the affected item path, and the action status, which lets you separate old history from a file that is still present or returning after cleanup.

Look for status labels such as threat found, quarantined, blocked, and remediation incomplete. If the path points to something that no longer exists, the alert may be stale history. If the same file path returns after restart or reconnect, treat it as a source problem.

Suppose a warning keeps naming a file on a USB stick you already removed. That points away from the PC itself and toward removable media or an old installer. A browser page that claims Windows Security found threats is a different case again.

Likely causes ranked

Most often, repeated popups come from stale Protection History or from a file that keeps coming back from quarantine, removable media, or a backup. Less commonly, the cleanup did not finish, or the alert is a browser notification that only looks like Defender.

Use this order before you delete folders or rerun scans. It keeps you from clearing history when the file is still active, or from chasing malware when the real source is a browser page.

Windows Security threat triage matrix

Stale protection history

Open Windows Security > Virus & threat protection > Protection History first and compare the detection name, affected item path, and action status. If the file is already removed and the path no longer exists, the entry can be stale history rather than active malware. Older Windows versions may label this area differently, but the same information is still the key clue.

When the alert is stale, the scan record can survive in Defender history files. If the entry is only old history and the file is gone, you can clear the stale record from Windows Security after confirming there is no live file remaining.

1. Open Windows Security > Virus & threat protection > Protection History.
2. Open the latest item and note the detection name, affected item path, and action status.
3. Confirm whether the file still exists at that path in File Explorer.
4. If the file is gone and the entry is old, close Windows Security.
5. Restart the PC if the entry continues to appear after a refresh.

Quarantined items keep coming back?

If the same threat returns after quarantine, the source copy is often still present somewhere else. That can mean the file was restored, re-downloaded, copied from another drive, or pulled back from a backup. Windows Security can show statuses such as quarantined, blocked, and remediation incomplete.

Use a second scan to confirm whether the same detection still appears after you remove the source copy. If the item keeps returning, check for another copy on the PC, on a removable drive, or inside a backup archive before you try another cleanup step.

1. Open Windows Security > Virus & threat protection > Protection History.
2. Check whether the same detection name returns with the same path.
3. Open File Explorer and search for the file name on internal drives, backups, and downloads.
4. Remove any other copy of the file before scanning again.
5. Run Microsoft Safety Scanner, then run a full scan in Windows Security.

External drives and USB sticks

External drives and USB sticks can keep reintroducing flagged files after every reconnect. Old backups, setup media, and ZIP archives can do the same thing.

Picture a USB installer that still holds an old setup file flagged as Win64/Expiro.DD!MTB. The PC looks clean after a reboot, then the same detection returns as soon as the drive is plugged in again. That is a source problem, not a fresh infection on the system drive.

1. Disconnect all external drives and USB sticks.
2. Open Windows Security > Virus & threat protection > Scan options.
3. Run a full scan on the PC with removable media unplugged.
4. Reconnect one drive at a time and scan each drive separately.
5. Check old installers, backups, and ZIP archives before copying anything back.

Is it a fake browser alert?

Browser notification scams can imitate Defender and send users toward fake security pages. If the popup appears in a tab or notification bubble, treat it as browser-side until proven otherwise.

Suppose a page says “Threat found” and asks you to click a button, but Windows Security shows no matching item in Protection History. That usually points to a site permission or a bad tab, not Defender. Close the page and clean up the browser permissions first.

1. Open the browser settings page for site notifications.
2. Remove any unknown or suspicious sites from the allow list.
3. Close the tab or window that shows the warning.
4. Clear recent site permissions if the browser keeps reopening the page.
5. Return to Windows Security only if Protection History shows a real detection.

Remediation incomplete after reboot

Use this path when the same threat returns after restart, or when the action status stays remediation incomplete. In that case, a quick scan is often too light, and the next step should run before Windows fully boots.

Microsoft Defender Offline scan is the next step here, according to Microsoft Learn. It requires a restart and runs before Windows fully boots, which helps when malware hides in memory or in boot-time components.

1. Open Windows Security > Virus & threat protection > Scan options.
2. Select Microsoft Defender Offline scan.
3. Save work, then restart when prompted.
4. After Windows loads, open Protection History and check whether the same threat remains.
5. If the item returns, run a full scan and then Microsoft Safety Scanner again.

Still not working?

If the popup loop continues, shift from cleanup to source isolation. Run Safe Mode with Networking, disconnect removable media, and recheck Protection History after startup. That is the clearest next escalation when repeated detections survive normal scans and Offline scan.

If the same file keeps appearing after you have already run the Offline scan, the remaining source may be a backup, archive, or USB installer that has not been cleaned yet. Recheck the source path before moving on to deeper repair steps.

1. Boot into Safe Mode with Networking.
2. Open Windows Security and run a full scan.
3. Check Protection History for the same detection name and path.
4. Scan removable drives separately before reconnecting them to normal use.
5. If the PC still flags the same file after Offline scan, contact vendor support or a local repair shop for deeper malware cleanup.

Frequently asked questions

Why does windows security keep popping up?

Usually because Windows Security still has a live detection, a stale Protection History entry, or a browser notification masquerading as a warning. Open Protection History first and check the detection name, path, and status. If no file exists there, look for browser permissions or leftover scan records.

Why do I keep getting windows security alert pop up?

The alert often comes back when the same source keeps feeding the detection. That source may be a USB stick, external drive, archive, or a quarantined item that returned. If the popup is in a browser tab, remove site notifications there instead of rerunning antivirus scans.

Why does Windows Security keep saying threats found after I remove them?

This usually means the item was not fully removed from every source. Check whether the same path appears again in Protection History, then scan the original drive, backup, or installer media. If the status shows remediation incomplete, use Microsoft Defender Offline scan and restart when prompted.

Why does Microsoft Defender keep detecting the same threat again?

Repeated detection usually means the file is being restored, copied back, or loaded from removable media. Check the quarantine and history records only after confirming the file is not still present elsewhere. Microsoft Safety Scanner can help verify the result.

How do I clear repeated threats from Windows Security history?

Start with Protection History, then confirm the file no longer exists. If the entry is stale, remove the old history record after making sure there is no live copy. If the same threat returns, also review the source media and rescan it.

How do I stop Windows Security from finding threats every reboot?

Use Microsoft Defender Offline scan, then run a full scan after Windows starts. If the same threat reappears, check boot-time persistence, removable media, and backup sources. Safe Mode with Networking is a useful fallback when normal cleanup still leaves a repeated detection after restart.