STATUS_VIRUS_DELETED (0XC0000907) – Real Fix for Fake Virus Warnings

What Is This Error?

You try to open a file — could be a Word doc, an EXE installer, a ZIP — and Windows slams the door with STATUS_VIRUS_DELETED (0XC0000907). Usually pops up when Windows Defender or third-party antivirus thinks the file is malicious. But here's the kicker: it's often a false positive. Last month I had a client with a 2019 QuickBooks installer that triggered this. The file was clean, but Windows flagged it because of an old signature update.

Get It Fixed in 30 Seconds: Restore From Quarantine

Don't go digging through event logs or reinstalling drivers. Start here.

1. Open Windows Security (search for it in Start).
2. Click Virus & threat protection.
3. Under Current threats, click Protection history.
4. Find the entry for your file — it'll show the error code and the file name.
5. Click Actions and choose Restore. Then also check Allow on device.

That puts the file back where it was and tells Windows to leave it alone. If you're running Windows 11 22H2 or later, you might see a separate Quarantine tab — same deal. This works 80% of the time.

5 Minute Fix: Disable Real-Time Protection Temporarily

Sometimes the restore doesn't stick because Defender re-scans the file instantly. Happened to a guy last week trying to open an old Photoshop plugin. Here's the workaround.

1. Open Windows Security.
2. Click Virus & threat protection > Manage settings.
3. Turn Real-time protection to Off. It'll stay off for a few minutes.
4. Copy the file to a new folder, say C:\Temp\.
5. Open it. It should launch now.
6. Turn real-time protection back On.

⚠️ Don't leave real-time protection off. You're in a race against time — Windows will turn it back on automatically after a short period (usually 5-10 minutes). If you need the file long-term, add an exclusion instead.

Add an Exclusion So It Doesn't Happen Again

1. In Windows Security, go to Virus & threat protection > Manage settings.
2. Scroll to Exclusions and click Add or remove exclusions.
3. Click Add an exclusion and pick File or Folder.
4. Navigate to where the file lives. If it's a whole folder of old tools, exclude the folder.

I tell clients: only exclude files you know are clean. If it's a random EXE from a sketchy site, maybe let it burn.

Advanced Fix (15+ Minutes): Check for Real Malware or a Bad Signature

If the error keeps happening even after restoring and excluding, you might actually have malware — or the file itself is corrupted. This happened with a client whose accounting software installer kept getting flagged. Turned out the download was corrupted from a dodgy mirror.

Step 1: Scan With a Second Opinion

Windows Defender is decent but not perfect. Use something free and portable.

• Malwarebytes (free scan) — download the portable version, run it, let it clean.
• Emsisoft Emergency Kit — boots from USB, scans deeper.

If either finds the file is actually malicious, delete it. If not, the file is likely a false positive.

Step 2: Check File Digital Signature

Right-click the file > Properties > Digital Signatures tab. If it has a signature from a trusted publisher (like Microsoft, Adobe, etc.), it's probably fine. If it says "This digital signature is not valid" or there's no signature at all, be suspicious.

Step 3: Disable Third-Party Antivirus Temporarily

If you run Norton, McAfee, or Avast, they can also cause 0XC0000907. I've seen Avast flag legitimate PDFs because of aggressive heuristics. Pause protection for 10 minutes, try opening the file, then re-enable.

Step 4: Use Command Line to Bypass Block

Open Command Prompt as admin. Navigate to the file's folder. Run:

takeown /f filename.ext && icacls filename.ext /grant administrators:F

Replace filename.ext with your actual file name. This forces ownership and full permissions. Then try opening it.

When to Just Give Up and Delete the File

If you've tried all the above and the file still won't open, or if it keeps getting re-quarantined, it's probably infected. Restore it once more, upload it to VirusTotal.com (it'll scan with 60+ engines). If more than a couple flag it, delete it. Had a client insist a torrented game was fine — 47 out of 60 engines flagged it. He deleted it. His PC ran faster the next day.

Final Word

0XC0000907 is usually a false alarm with a quick fix. Start with restoring from quarantine. If that fails, temporarily disable real-time protection. For stubborn cases, check with a second scanner or examine the digital signature. Most people are done in 5 minutes. Don't let it scare you — but don't ignore it if the file looks truly shady.