Windows Defender Found Threats But Won't Remove? Fix It

You opened Windows Security and saw it found one or more threats. Maybe a trojan, a PUP, or something called "Behavior:Win32/Sabsik.FL.A!ml." But when you click the "Remove" button, nothing happens. Or the button is grayed out. Or it says "Action needed" but the only option is "Start actions" and after clicking that, it spins for a while and then says "Threats found — same list." This usually happens after a quick scan or a full scan. You're stuck in a loop.

Here's why. Windows Defender detects the threat, but it can't clean it because the malware has locked itself into a protected folder, or it's running as a background process Defender can't touch without a reboot. Sometimes Defender itself is corrupted — the service isn't running right or the quarantine database has a glitch. Another common reason: the threat is inside a System Volume Information folder or a Windows component store that Defender can't modify while Windows is running.

The fix isn't complicated, but you must do the steps in order. Skip around and it won't work.

Step 1: Boot into Safe Mode with Networking

Click Start, then the Power icon. Hold down the Shift key on your keyboard and click "Restart."
Your computer will restart into a blue screen with choices. Click Troubleshoot.
Click Advanced options.
Click Startup Settings.
Click Restart.
After the restart, you'll see a list of numbers. Press 5 or F5 for Safe Mode with Networking.
Log in with your normal password. You'll see a bare desktop — that's normal.

After you log in, open Windows Security again (search for "Windows Security" from the Start menu). Go to Virus & threat protection and check the current threats. They should still be there. Now click Start actions or Remove. This time it should work because Defender can now access locked files.

Step 2: If It Still Won't Remove, Use an Offline Scan

Safe Mode not enough? The malware might be hiding deeper. Windows Defender has an offline scan that runs before Windows fully boots. This catches things that hide in memory or boot sectors.

Back in normal Windows (not Safe Mode), open Windows Security.
Click Virus & threat protection.
Under "Current threats," click Scan options.
Select Microsoft Defender Offline Scan.
Click Scan now.
Your computer will restart and show a blue screen with a progress bar. This takes 10–30 minutes depending on your hard drive.
After the scan finishes, it will restart into Windows. Open Windows Security to see if the threats are gone.

I've seen this fix about 80% of the cases where Defender gets stuck. The offline scanner is more thorough and can delete files Defender can't touch while Windows is running.

Step 3: Manually Remove the Threat Using Command Line

Offline scan didn't work either? Time to get your hands dirty. We'll use the command line tool that Defender uses behind the scenes.

Right-click the Start button and select Windows Terminal (Admin) or Command Prompt (Admin).
At the command prompt, type this and press Enter:
```
cd %ProgramFiles%\Windows Defender
```
Then type:
```
MpCmdRun -RemoveDefinitions -All
```
Wait for it to finish. This clears Defender's current threat definitions and updates them from scratch.
Next, type:
```
MpCmdRun -SignatureUpdate
```
After the update completes, type:
```
MpCmdRun -Scan -ScanType 2
```
This runs a full scan from the command line. Let it complete — can take an hour.

The command line version of Defender often removes threats that the GUI version can't. I don't know why, but it just works.

Step 4: Reset Windows Defender If Nothing Else Works

Sometimes Defender itself is broken. The service got corrupted by the malware or a bad Windows update. Here's how to reset it completely.

Open Windows Terminal as Admin again.
Type these commands one by one, pressing Enter after each:
```
net stop windefend
sc config windefend start= disabled
```
Restart your computer.
After restart, open Windows Terminal as Admin again and type:
```
sc config windefend start= auto
net start windefend
```
Restart one more time.
Open Windows Security and run a full scan. The threats should now be removable.

This forces Defender to rebuild its quarantine database from scratch. I've used this trick on dozens of machines that had the same "threat found but can't remove" issue.

What to Check If It Still Fails

If after all these steps Defender still won't remove the threat, you've got a bigger problem. Check these three things:

Is the malware actually gone? Sometimes Defender reports a threat that's already been removed by another tool. Open Windows Security, click Protection history, and look for items already in quarantine or removed. If you see "Removed" next to a threat, you're fine — Defender just didn't update the main screen.
Do you have another antivirus installed? If you have McAfee, Norton, or even Malwarebytes running alongside Defender, they can interfere. Uninstall the other antivirus, restart, and try again. Defender and other AVs don't play nice together.
Is the file in a protected system folder? Some malware hides in "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache." Defender can't touch that folder because it's a protected OS location. In this case, you need to boot from a rescue disk (like a Windows installation USB) and delete the file manually. I'd recommend using a tool like Kaspersky Rescue Disk or Bitdefender Rescue Disk — they boot from USB and can delete anything.

One last thing: if the threat is something like "Trojan:Win32/Wacatac.B!ml" and it keeps coming back, it's probably a browser hijacker or adware that's reinstalling itself from a scheduled task or browser extension. Run your antivirus, then check your browser extensions (remove any you don't recognize), and use a free tool like AdwCleaner to sweep for leftover junk.

I've been doing this for over a decade. The command line reset in Step 4 has saved my skin more times than I can count. Try it before you give up.