| Previous | Next |
| STATUS_VIRUS_INFECTED | STATUS_BAD_MCFG_TABLE |
STATUS_VIRUS_DELETED
The file was removed as part of a malware or unwanted-software response
STATUS_VIRUS_DELETED describes the post-detection state: the file cannot be opened because protective action removed it from the original location. It is different from STATUS_VIRUS_INFECTED, which reports detection without necessarily saying that removal has already completed.
Use the security product's evidence rather than recreating the missing file from an unverified copy. Microsoft Defender records malware-protection events and exposes Protection history and quarantine workflows. A quarantined item may be restorable after review, while a removal action can leave no normal file at the original path.
For enterprise diagnostics, record the threat name, SHA-256, action, engine/signature versions and source path. If the file is a suspected false positive, submit or restore it only through the approved security workflow and isolate it from production execution until the determination is complete.
What to inspect
- Defender or third-party antimalware event records for the exact timestamp and path.
- Whether the action was quarantine, remove, block or remediation failure.
- The file hash and detection name before any attempt to restore or replace the item.
References
- Microsoft: Defender Antivirus event IDs and error codes
- Microsoft: Restore quarantined files
- Microsoft: Defender command-line restore options
- Microsoft Open Specifications: NTSTATUS values
Looking for a different code? Search another status or error code.