A Windows Security notification that says a threat was blocked is usually good news: protection saw something suspicious and stopped it. Still, you should check what was found and whether any follow-up action is needed.
Does this affect you?
Use this for Windows 10 or Windows 11 PCs using Windows Security, also called Microsoft Defender, when you see Threat blocked, threats found, or a similar antivirus alert.
See exactly what was found
The notification is only a summary. Protection history has the useful details.
- Open Start, search for Windows Security, and open it.
- Choose Virus & threat protection.
- Open Protection history.
- Find the entry from around the time the notification appeared.
- Expand it and read the Detection name and File path. The path may show whether it came from Downloads, an email attachment, a USB drive, or another location.
- Check Action taken. Removed or Quarantined usually means Windows handled it.
- If the entry says Action recommended, follow the prompt to remove or quarantine the item.
Run a full scan
A blocked file can be part of a larger download, so a full scan is a good sanity check.
- In Windows Security, open Virus & threat protection > Scan options.
- Choose Full scan.
- Click Scan now and let it complete, even if it takes an hour or more.
- If the scan is clean, the earlier threat was likely stopped before spreading.
- If more threats appear, follow Windows Security prompts to remove or quarantine each one.
Check whether anything ran first
This matters most when the file path matches something you opened.
- Review Protection history and the timestamp.
- If the file was blocked or quarantined before execution, there is usually nothing else to do after a clean scan.
- If the detection happened after you opened or ran the file, be more cautious.
- Change important passwords from a trusted device and watch accounts for unusual activity over the next few days.
- If you are unsure, the full scan result is the best next evidence.
More control
False positives happen
Windows Security can block legitimate tools such as game mods, older utilities, or scripts because their behavior resembles malware. Search Microsoft documentation for the exact detection name before assuming a trusted file is definitely malicious.
Repeated detections matter more
One blocked browser download is common. Repeated detections from the same source or over several days deserve closer attention.
Keep cloud protection on
Cloud-delivered protection and automatic sample submission help Microsoft react to new threats faster than signature updates alone. Keep both enabled in Virus & threat protection settings.
Use a second opinion if needed
If the PC still behaves oddly after a clean full scan, a second-opinion scan with Malwarebytes Free can catch threats another engine missed.
Sources
- Microsoft Support – Protection history in the Windows Security app (2025)
- Microsoft Support – Stay protected with Windows Security (2025)
- Malwarebytes – What is a false positive? (2025)