Step-by-step Guide to Restoring Windows Defender After a Malware Infection

by

Malware infections can disable or weaken Windows Defender, leaving your system vulnerable. Restoring Windows Defender is crucial to maintaining your computer’s security. This step-by-step guide will help you re-enable and restore Windows Defender after a malware attack.

Step 1: Boot into Safe Mode

Starting your computer in Safe Mode prevents malware from interfering with the repair process. To do this:

  • Press Windows key + R to open the Run dialog.
  • Type msconfig and press Enter.
  • In the System Configuration window, go to the Boot tab.
  • Check the box for Safe Boot and select Minimal.
  • Click OK and restart your computer.

Step 2: Run a Malware Scan

Use a reputable anti-malware tool to scan your system. If Windows Defender was disabled, consider installing an alternative scanner temporarily.

Popular options include Malwarebytes or HitmanPro. Follow their instructions to perform a full system scan and remove any threats.

Step 3: Re-enable Windows Defender

If Windows Defender is disabled, you can re-enable it via Group Policy or Registry Editor.

Using Group Policy Editor

Note: Group Policy is available only in Windows 10/11 Pro, Enterprise, or Education editions.

To re-enable Defender:

  • Press Windows key + R, type gpedit.msc, and press Enter.
  • Navigate to Computer Configuration > Administrative Templates > Windows Components > Microsoft Defender Antivirus.
  • Double-click on Turn off Microsoft Defender Antivirus.
  • Select Not configured or Disabled.
  • Click Apply and OK.

Using Registry Editor

Warning: Editing the registry can cause serious problems if done incorrectly. Proceed with caution and back up your registry first.

To enable Defender via Registry:

  • Press Windows key + R, type regedit, and press Enter.
  • Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender.
  • Find the DisableAntiSpyware DWORD.
  • Set its value to 0 or delete the DWORD.
  • Restart your computer.

Step 4: Update Windows and Defender

Ensure your Windows system and Defender are up to date. Updates often include security patches and improvements.

To update Windows:

  • Go to Settings > Update & Security > Windows Update.
  • Click Check for updates.
  • Install any available updates and restart your computer.

To update Windows Defender:

  • Open Windows Security from the Start menu.
  • Navigate to Virus & Threat Protection.
  • Click Check for updates under Virus & Threat Protection Updates.

Step 5: Verify Windows Defender is Active

After updates, restart your computer normally. Open Windows Security and confirm that Windows Defender Antivirus is active and protecting your system.

If Defender is still disabled, consider running the Windows Troubleshooter or seeking professional support.

Conclusion

Restoring Windows Defender after a malware infection involves booting into Safe Mode, scanning for threats, re-enabling Defender, updating your system, and verifying protection. Regular maintenance and security practices help prevent future infections and keep your system secure.