What to Do When Antivirus Deletes a Downloaded File

Start by judging the source, not the alert. Did the file come from the publisher's official website, and does its checksum match the value the vendor publishes? Is it a well-known open-source tool? Those point toward a false positive. On the other hand, a 'cracked' app, a keygen, a file from a torrent or a random link, or anything you didn't intend to download leans heavily toward a real detection you should respect.

A quick, decisive test is to upload the file (or its hash) to VirusTotal. If only one or two obscure engines flag it while the major ones pass, it is very likely a false positive. If many reputable engines agree, leave it quarantined.

Most antivirus tools don't truly delete a threat right away; they move it to an encrypted quarantine folder where it can't run. That means recovery is usually possible if you decide the file is safe. In Microsoft Defender, open Windows Security > Virus & threat protection > Protection history to see what was removed and why.

From there you can review the detection name, which often hints at whether it's a generic heuristic flag (frequently a false positive) or a specific known malware family (take seriously).

Once you are confident the file is a false positive, restore it from quarantine rather than re-downloading into the same trap. In Windows Security, open Protection history, click the blocked item, and choose Restore (or Allow on device). For third-party antivirus, look for a Quarantine or Vault section with a Restore option.

To stop it being re-quarantined, add a targeted exclusion for that specific file or its folder. Keep exclusions as narrow as possible — never exclude an entire drive or your Downloads folder wholesale.

If a legitimate app is wrongly flagged, you can help fix it for everyone by submitting the file to the antivirus vendor. Microsoft, for example, accepts samples through its Defender submission portal, and most vendors have a similar process. They review the file and update their definitions so future scans pass it.

This is especially worth doing for popular open-source tools, where a single false positive can affect thousands of users.

If the file came from an unofficial source, a crack or keygen, an unexpected email attachment, or a flashy ad button, and especially if multiple reputable engines flagged it, trust your antivirus. Do not restore it, do not add an exclusion, and run a full system scan to be sure nothing else slipped through. No piece of 'free premium' software is worth a compromised machine.