Windows 10 Defender Threat Keeps Coming Back: Stopping Malware That Returns After Removal
Windows Security reports that it found a threat and removed it. The next day, or after a restart, the same threat name appears again. When a Windows 10 Defender threat keeps coming back, something YYPAUS Login on the PC is recreating or reintroducing it.
Defender removes the files it detects, but it can only remove what it sees. If the original installer, a browser extension, a scheduled task, or an infected USB drive remains, the malware simply returns.
Protection history records where each detection was found, and that location is the best guide to the source.
Breaking the cycle means removing the source, not just the copy that Defender keeps catching.
Why This Happens
Threats return for these reasons:
- The original infected file is still in Downloads, on the desktop, or on a USB drive.
- A browser extension or unwanted program reinstalls the malware.
- A scheduled task or startup entry recreates the file.
- A synced cloud folder or shared network drive brings the file back.
Detections labelled as “potentially unwanted” often come from bundled software that keeps reinstalling itself.
Start With These Basic Checks
Find where the threat lives.
- Open Windows Security > Virus & threat protection > Protection history.
- Select the repeated detection and note the full file path and threat name.
- If the path is in Downloads or on a USB drive, delete the original file and scan the drive.
- Remove unfamiliar browser extensions and reset browsers.
- Uninstall recently added programs you do not recognise, then run a full scan.
If the path points to OneDrive or a network share, clean the file there, or it will sync back.
Going a Step Further
Clean more thoroughly.
- Open Windows Security > Scan options, choose Microsoft Defender Offline scan, and select Scan now. The PC restarts and scans before Windows loads.
- Open Task Scheduler and look for unknown tasks in the main library with odd names or file paths in AppData.
- Disable suspicious entries in Task Manager’s Startup tab.
- Download and run the Microsoft Safety Scanner from Microsoft’s website for a second opinion.
- Turn System Protection off and on again to clear old restore points if they contain the infection, then create a fresh restore point.
If the threat still returns after all of this, back up personal files, scan the backup, and consider resetting Windows.
A Word of Caution
Do not restore quarantined items unless you are certain they are false positives. After cleaning, change passwords for important accounts from a clean device. Scan USB drives before using them on other computers.
Final Thoughts
A threat that keeps returning means its source is still present. Use Protection history to locate it, remove the original file, extensions, and tasks, and run an offline scan.