If Windows Security is missing, disabled, or not working after malware removal, the problem is often deeper than a simple app glitch.
This guide shows how to fix Windows Security after malware removal and verify that Microsoft Defender is fully restored.
Why Windows Security can break after malware removal
Malware often targets security tools first because disabling Microsoft Defender, Firewall, and related services makes persistence easier.
Even after the malware is removed, its changes can remain in the registry, policy settings, services, or scheduled tasks.
Common signs include:
- Windows Security opens to a blank page or error message
- Virus & threat protection is unavailable
- Real-time protection is turned off and cannot be enabled
- Windows Security says the IT administrator controls settings
- Defender services fail to start
- Security notifications are missing
Confirm the malware is fully removed
Before repairing Windows Security, make sure no active threat is still present.
If malware is still running, it can undo every fix you apply.
Run an offline scan
Use Microsoft Defender Offline scan if possible.
It restarts the PC and scans outside the normal Windows session, which helps catch hidden malware and rootkits.
Use a trusted second opinion scanner
If you already used one tool, run a reputable second-opinion scanner such as Malwarebytes, ESET Online Scanner, or Microsoft Safety Scanner.
Avoid random “repair” tools, which can add more damage.
Restart essential Windows Security services
Windows Security depends on several services.
If malware stopped or disabled them, Defender may appear broken even when the app itself is intact.
Open Services and check these items:
- Microsoft Defender Antivirus Service
- Security Center
- Windows Security Service
- Base Filtering Engine
- Windows Firewall
Set services to their default startup type when possible, then start any that are stopped.
If a service cannot start, note the error message because it often points to policy damage or file corruption.
Reset Windows Security app components
The Windows Security app can become corrupted after malware removal.
Resetting it can restore missing pages, broken buttons, and empty dashboards.
Use the Settings app
Go to Settings > Apps > Installed apps, find Windows Security, then choose Advanced options.
Select Repair first.
If that does not help, choose Reset.
Update the Windows Security platform
Windows Defender uses a security intelligence engine that updates separately from normal app updates.
Open Windows Update and install every pending update, then check for security intelligence updates through Microsoft Defender.
Check Group Policy and registry changes
Many malware families disable Defender by changing policy settings.
On Windows Pro or Enterprise, Group Policy is often the source of the problem.
On Windows Home, registry changes are more common.
Group Policy settings to inspect
Open the Local Group Policy Editor and review Microsoft Defender Antivirus policies.
Look for settings that disable the antivirus engine, real-time protection, or cloud-delivered protection.
Pay special attention to:
- Turn off Microsoft Defender Antivirus
- Real-time Protection policies
- Cloud-delivered protection
- MAPS or sample submission restrictions
If any of these are enabled, set them back to Not Configured unless your organization requires a different policy.
Registry entries that may block Defender
Check for malware-created values under Microsoft Defender policy paths.
Look for keys that disable antivirus features or redirect security settings.
If you are not comfortable editing the registry, create a backup or use a trusted IT technician, since registry mistakes can cause system instability.
Repair system files with built-in tools
Malware often damages protected Windows files, especially if it tampers with drivers or system libraries.
Two built-in tools can repair this damage without reinstalling Windows.
Run System File Checker
Open an elevated Command Prompt and run:
- sfc /scannow
This checks protected files and replaces corrupted copies with known-good versions.
Run DISM
If SFC reports problems it cannot fix, run:
- DISM /Online /Cleanup-Image /RestoreHealth
DISM repairs the Windows component store, which SFC depends on.
After DISM finishes, run sfc /scannow again.
Re-register or repair Windows Security using PowerShell
In some cases, the Windows Security app package becomes misregistered.
Re-registering it can restore the interface without changing your security configuration.
Open PowerShell as Administrator and use Microsoft-supported repair methods if needed.
If the app still fails, focus on services and policy settings rather than repeatedly reinstalling the same package.
Also verify that Windows Management Instrumentation and Security Center are working, because Windows Security depends on them for status reporting.
Restore Firewall and network protection
Malware often disables the firewall to allow remote access or data theft.
If Windows Security reports firewall issues, restore it before assuming Defender is fixed.
Check that these firewall-related items are active:
- Windows Defender Firewall
- Base Filtering Engine
- Network protection features
- SmartScreen reputation-based protection
If the firewall profile remains off after cleanup, reset firewall settings to default using Windows security options or the netsh command in an elevated prompt.
Remove malicious exclusions and unauthorized admin changes
Some malware adds exclusions so it can hide in plain sight.
Even if Defender is active, those exclusions can leave dangerous folders unscanned.
Review these areas:
- Antivirus exclusions
- Controlled folder access exceptions
- Allowed threat history items
- Unknown local administrator accounts
Remove anything you did not create intentionally.
Also check whether the malware added a new admin account or enabled Remote Desktop settings you do not recognize.
Update Windows and security intelligence
After malware removal, updates matter because Microsoft regularly publishes Defender platform improvements and threat definitions.
A fully patched system is much harder to reinfect.
Install all pending:
- Windows cumulative updates
- Microsoft Defender security intelligence updates
- Driver updates from trusted sources only
If Windows Update itself fails, fix update errors first, because Defender often relies on current system components.
When to reset Windows or use recovery tools
If Windows Security still does not work after services, policies, system files, and updates have been repaired, the infection may have left deeper corruption.
At that point, a repair install or full reset may be faster and safer than continuing to troubleshoot.
Consider these options in order:
- In-place repair install to refresh Windows while keeping files and apps
- Reset this PC with cloud download if the system is unstable
- Clean reinstall if you suspect persistent compromise
Back up important files first, but scan backups before restoring them to avoid reintroducing malware.
How to verify Windows Security is fixed
After repairs, confirm that protection is genuinely restored and not just visually working.
- Open Windows Security without errors
- Check that Virus & threat protection shows active status
- Verify real-time protection can be toggled on
- Confirm firewall profiles are enabled
- Run a quick scan successfully
- Check that security intelligence updates install normally
If all of those checks pass, Windows Security is likely back to a healthy state and ready to protect the device again.