Antivirus Quarantined a System File – Here’s the Fix

Quick answer for advanced users

Open your antivirus quarantine list, find the file (look for .dll, .exe, .sys files in C:\Windows or C:\Windows\System32), restore it, then restart your PC. If it still acts up, run sfc /scannow from an admin command prompt to repair damage.

Why does this happen?

Your antivirus software – whether it's Windows Defender, Norton, McAfee, or Malwarebytes – sometimes gets jumpy. It sees a system file that behaves like malware: maybe it tries to access the registry, or it has a strange name, or it triggers a generic heuristic rule. It quarantines the file, and suddenly Windows won't boot, or you get a blue screen, or an app crashes.

Had a client last month whose entire print queue died after Defender quarantined spoolsv.exe. The file looked suspicious to the antivirus because it was running in a context that Defender didn't expect. Actually, it was just the print spooler doing its job.

This happens more often after a Windows update (like Patch Tuesday) or when you install a new version of your antivirus. The antivirus gets updated rules, and sometimes those rules are too aggressive. Microsoft's own Defender is actually one of the worst for this – it flagged ntdll.dll for one client after a cumulative update in late 2024.

How to fix it: Step-by-step

1. Open your antivirus quarantine. For Windows Defender, go to Windows Security > Virus & threat protection > Protection history. Look for an item that says "Quarantined" and click it. For third-party antivirus, open the main dashboard, find "Quarantine" or "Threats quarantined".
2. Find the flagged file. Look at the file path in the quarantine details. If it's in C:\Windows\System32 or C:\Windows, or a subfolder like drivers or Microsoft.NET, it's probably a false positive. Defenders often flag svchost.exe, lsass.exe, winlogon.exe, ntoskrnl.exe, kernel32.dll, or user32.dll.
3. Restore the file. Click "Restore" or "Allow on device." For Defender, click the down arrow on the item, then "Restore." If it asks for admin permission, say yes.
4. Restart your PC. This reloads the system file and should fix the crash, the blue screen, or the app error.
5. Run a system file check. Open Command Prompt as admin (search "cmd", right-click, run as admin). Type sfc /scannow and press Enter. Let it finish – it checks for corrupted system files and replaces them from a cached copy.

Alternative fixes if the main one fails

If you can't boot normally

Boot into Safe Mode. On Windows 10/11, hold Shift while clicking Restart. Or, mash F8 during boot (harder on modern UEFI systems). Once in Safe Mode, open your antivirus and restore the file from there.

If the file is already deleted

Check the Recycle Bin first. If it's not there, the antivirus may have permanently removed it. In that case, you need to reinstall the component. For a system file, run DISM /Online /Cleanup-Image /RestoreHealth in an admin command prompt. It downloads a fresh copy from Windows Update. Then run sfc /scannow again.

If Windows won't boot at all

Use Windows Recovery Environment (WinRE). Boot from a Windows installation USB, select "Repair your computer," then Troubleshoot > Advanced options > Command Prompt. Run sfc /scannow /offbootdir=C:\ /offwindir=C:\Windows. Replace C: with your actual Windows drive letter (it might be D: in recovery).

Prevention tip

Add an exclusion for the system folder that caused the issue. In Windows Defender, go to Windows Security > Virus & threat protection > Manage settings > Add or remove exclusions. Add C:\Windows\System32 as a folder exclusion. This tells Defender to ignore that folder in the future. Only do this if you're sure the file is legit – if you've already scanned the whole system with a second opinion scanner (like Malwarebytes), you're safe.

Also, keep your antivirus updated. False positives are often fixed in the next definition update. But if Defender is causing you regular grief, consider switching to a less aggressive AV like Bitdefender or Kaspersky – they're less likely to quarantine your system files.

Final thought: don't trust your antivirus blindly. If a file is flagged and you know it's from Windows, restore it. I've seen too many small businesses lose a day of work because someone clicked "Delete" instead of "Restore." Take the 5 minutes to fix it now.