# Defender keeps removing the same threat: how to find what's bringing it back

> Windows Defender keeps finding the same threat at random times? How to find the trigger with Event Viewer, PowerShell and Autoruns, and when to reinstall.

Canonical: https://www.phishclean.com/blog/defender-keeps-removing-same-threat
Last updated: 2026-11-05

November 5, 2026 - 6 min read

By PhishClean Research Team

Removal isn't failing. Something is recreating the file, or you're seeing an old record. Here's how to read Defender's own logs to find out which, without guessing.

Defender pops up, says it removed a threat, and an hour or a day later it does it again. A recent r/computerviruses post asked the right question: how do I find its trigger? Each cleanup is usually working. The file is being removed, then something puts it back. So stop running more scans for the moment, and work out what that something is.

**Read this first.** If the name includes "Stealer", "Steal" or a known stealer family, or if the threat is tied to a crack or a command you pasted from a website, assume your passwords may be gone. Change your email and banking passwords from a *different* device now, and carry on with the investigation afterward.

## Step 1: Read the detection itself

Open **Windows Security**, then **Virus & threat protection**, then **Protection history**. Click the latest entry and note the threat name and the **Affected items** path. The path tells you most of what you need.

## Step 2: Get the times and the process from the logs

Protection history is short on detail. Event Viewer has more. Go to **Applications and Services Logs**, **Microsoft**, **Windows**, **Windows Defender**, **Operational**. The events you want are:

- **1116:** Defender detected malware or unwanted software.
- **1117:** Defender took action to protect the machine.

Each one lists the threat name, severity, **Path**, **Detection Origin** (such as local computer, network share or internet), **Detection Source** (such as real-time, system or AMSI), the **User** and the **Process Name**. To pull them all at once, open PowerShell as administrator:

```
Get-WinEvent -FilterHashtable @{
  LogName = 'Microsoft-Windows-Windows Defender/Operational'
  Id = 1116, 1117
} -MaxEvents 40 | Format-List TimeCreated, Id, Message
```

Or use Defender's own cmdlet, which returns every time a threat was seen:

```
Get-MpThreatDetection |
  Sort-Object InitialDetectionTime -Descending |
  Select-Object -First 20 InitialDetectionTime, ThreatID, ProcessName, DomainUser, ActionSuccess, Resources |
  Format-List
```

Write down the time of the last five or so detections. You need the pattern.

## Step 3: Match the clues to a cause

These are rules of thumb rather than certainties, but they narrow things down quickly.

| What you see | Likely cause | Where to look next |
| --- | --- | --- |
| Path is in a browser cache, process is `chrome.exe` or `msedge.exe` | A web page, ad or extension keeps delivering it | Extensions, notification permissions, startup pages, a tab that reopens |
| Same time each day or every few hours | A scheduled task | Task Scheduler and Autoruns |
| Right after startup or sign-in | A startup entry or service | Autoruns: Logon and Services tabs |
| Process is `powershell.exe`, `wscript.exe` or `mshta.exe`; source is AMSI | A script is running, and something launches it | Scheduled tasks and WMI entries in Autoruns. This one is serious. |
| Path is in OneDrive, Dropbox or a backup folder | Sync or restore is putting the file back | Delete the file in the cloud copy and its version history too |
| Detection origin is a network share | Another machine or a shared folder has the file | Scan the file server and the other PCs on the network |
| Only during scheduled scans, always in the same archive or Downloads | A dormant file, such as an old installer or ZIP | Delete the original, and any copy inside an archive |
| A game tool, keygen or crack you use on purpose | You're restoring it, or the program restores it | Decide whether you can trust it. Usually you can't. |
| Same old timestamp, no new 1116 events | Just a stale history entry | No live threat. Run a full scan to confirm. |

## Step 4: Find what's recreating it

### Autoruns

[Autoruns](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns) is Microsoft's free Sysinternals tool. It lists everything set to start automatically: Run keys, services, drivers, scheduled tasks, WMI entries and more. Run it as administrator, then in the **Options** menu turn on the filter that hides Microsoft entries, and enable signature checks and VirusTotal lookups in the scan options.

Look for unsigned items running from `AppData`, `Temp` or `ProgramData`, for random-looking names, and for tasks that launch PowerShell with a long encoded command. To disable an entry, untick its box rather than deleting it, so you can undo a mistake. Save the output first.

### Process Monitor, if you still can't see it

[Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon) records file activity live, so it can catch the file being written. Add a filter for *Path contains* and the file's name, turn on **Drop Filtered Events** in the Filter menu to keep memory use down, and leave it running until the next detection. The **Process Name** column shows what wrote the file. For longer watches on a work machine, Sysmon's file-create event (ID 11) does the same job in the background.

### Check the browser separately

Autoruns won't tell you about a page that keeps pushing a download. Open your extensions page and remove anything you don't recognize. Check site notification permissions, too, since [those "click Allow" pop-ups](https://www.phishclean.com/blog/why-sites-ask-you-to-click-allow-notifications) can keep sending scam prompts long after you've left the page. Also look at your startup pages and search engine.

## Step 5: Clean, then confirm

1. Remove the source you found, then delete the file it created.
2. Run a **Microsoft Defender Offline scan** (Windows Security, Virus & threat protection, Scan options). It restarts into a separate environment, so it can catch malware that hides while Windows is running. Save your work first.
3. Watch for new 1116 events over the following few days. No new events means you've likely got it.

## Could it be a false alarm?

It happens, especially with niche tools, game mods and software you built yourself. If the path points to a program you trust, [submit the file to Microsoft](https://www.microsoft.com/en-us/wdsi/filesubmission) for analysis. Don't add an exclusion until you've done that. An exclusion on a folder means Defender stops looking there, and that also applies to whatever arrives there next.

## When to stop and reinstall

Rebuilding is the right answer if any of these apply:

- You find a backdoor, remote-access tool or info-stealer.
- Something turned Defender off, or added exclusions you didn't set.
- The threat is still returning after you removed everything you could find.
- It's a work machine. Tell IT rather than cleaning it yourself, since they may need the evidence.

Back up only your documents and photos. Don't back up programs. Then reinstall Windows, and change your passwords and revoke sessions from a clean device. A persistent threat means you can't be sure what it took. If it came from a command you pasted from a web page, our post on the [Win+R CAPTCHA trick](https://www.phishclean.com/blog/captcha-told-me-to-press-win-r-is-it-a-virus) explains what probably happened.

## Where PhishClean fits

It doesn't remove malware. It's a browser extension, and it can't see or fix what's already on your computer. It can help stop the next one at the step before it lands. It warns on fake CAPTCHA and "paste this command" pages for free, and on disguised downloads and fake browser updates on the paid plan. Use Defender for the cleanup.

## Frequently asked questions

### Why does Windows Defender keep finding the same threat?

Usually something is recreating the file: a scheduled task, startup entry, browser page, sync folder or a copy inside an archive. Sometimes it's only an old history entry. Check Event Viewer for new 1116 events to tell the difference.

### How do I find what triggered a Defender detection?

Look at event IDs 1116 and 1117 in the Windows Defender Operational log, or run Get-MpThreatDetection in PowerShell. Check the Path and Process Name fields and compare the timing. Then use Autoruns or Process Monitor to identify the source.

### Is my computer still infected if Defender says the threat was removed?

Not necessarily, but repeated detections suggest there's a source Defender hasn't dealt with. If the threat is a password stealer or remote-access tool, change your passwords from a different device, and consider reinstalling Windows.

### Should I add an exclusion to stop the alerts?

Not until you know it's a false alarm. An exclusion stops Defender from checking that location, including anything else that lands there. Submit the file to Microsoft for analysis first.

[A CAPTCHA told me to press Win+RHow a pasted command plants this kind of threat.](https://www.phishclean.com/blog/captcha-told-me-to-press-win-r-is-it-a-virus) [How to remove a fake virus pop-upWhen the alert isn't from Defender at all.](https://www.phishclean.com/blog/how-to-remove-fake-virus-popup) [Click Allow to continue?How to revoke notification spam.](https://www.phishclean.com/blog/why-sites-ask-you-to-click-allow-notifications) [I clicked a phishing linkA step-by-step recovery checklist.](https://www.phishclean.com/help/clicked-a-phishing-link)

## Sources

- [Microsoft Learn: Defender Antivirus event IDs and error codes](https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus)
- [Microsoft Learn: Get-MpThreatDetection](https://learn.microsoft.com/en-us/powershell/module/defender/get-mpthreatdetection)
- [Microsoft Sysinternals: Autoruns](https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns)
- [Microsoft Sysinternals: Process Monitor](https://learn.microsoft.com/en-us/sysinternals/downloads/procmon)
- [Microsoft Learn: Microsoft Defender Offline](https://learn.microsoft.com/en-us/defender-endpoint/microsoft-defender-offline)
- [Winhelponline: Defender shows the same threat repeatedly](https://www.winhelponline.com/blog/windows-defender-identifies-same-threat-repeatedly/) (stale history entries)

## Stop the next one before it lands

PhishClean warns on fake CAPTCHA pages for free, and on disguised downloads and fake updates on the paid plan, before anything runs.

[Install PhishClean free](https://www.phishclean.com/#install)

Last updated: 5 November 2026