Fix: 'Operation did not complete successfully because the file contains a virus'

beginner🪟 Windows2026-06-30| Windows 10, Windows 11, Windows Server 2019/2022

Error Message

Operation did not complete successfully because the file contains a virus or potentially unwanted software.
#windows-defender#security#antivirus#false-positive#devops

TL;DR: The 30-Second Fix

Windows Defender just quarantined your file because it flagged it as a threat. If you trust the file—perhaps it is a tool you wrote or a verified open-source utility—you can bring it back instantly.

  • Search for Windows Security in your Start menu and open it.
  • Select Virus & threat protection, then click Protection history.
  • Locate the recently blocked file (look for the exact timestamp).
  • Click Actions and choose Allow on device or Restore.
  • Try running your file again.

Why is Windows blocking my file?

This error isn't just a suggestion; it is a hard block. The Windows real-time protection engine intercepted a CreateProcess or OpenFile command and moved the file to a secure sandbox before it could run. While this protects users from actual malware, it often triggers "false positives" for power users and developers.

Developers see this most often when working with:

  • New Binaries: Unsigned .exe files compiled from Go, Rust, or C++ that lack a known reputation.
  • PyInstaller: Python scripts bundled into single executables often trigger generic trojan signatures.
  • Security Tools: Network scanners like nmap or memory tools that Windows views as suspicious.
  • Compressed Archives: Downloaded .zip or .7z files containing scripts that modify system registry keys.

How to Resolve the Block

Method 1: Recover the File from Quarantine

Windows usually hides the file in a hidden system folder rather than deleting it. You can pull it back through the security dashboard.

  • Open Windows Security via the taskbar or Start menu.
  • Head to Virus & threat protection.
  • Under the "Current threats" section, click Protection history.
  • Find the entry labeled "Threat blocked" or "Quarantined item."
  • Expand the entry. You will likely need to click "Yes" on a User Account Control (UAC) prompt.
  • Click the Actions button and select Allow.

Method 2: Create a Developer Exclusion Folder

Constantly restoring files is a headache. If you are a developer, the best move is to designate a specific folder where Defender will never scan. This saves time and CPU cycles.

  • Go to Windows Security > Virus & threat protection.
  • Click Manage settings under the "Virus & threat protection settings" header.
  • Scroll to the bottom and click Add or remove exclusions.
  • Click Add an exclusion and choose Folder.
  • Select your project root, such as C:\Users\Work\Projects. Anything inside this path will now run without interference.

Method 3: Automate Exclusions with PowerShell

Need to apply these settings to a remote server or a new CI/CD runner? Use an elevated PowerShell session to skip the UI entirely.

# Exclude your entire project directory
Add-MpPreference -ExclusionPath "C:\Dev\MyProject"

# Tell Defender to ignore a specific executable name
Add-MpPreference -ExclusionProcess "custom-compiler.exe"

# Ignore all files with a specific dev extension
Add-MpPreference -ExclusionExtension ".log"

Method 4: Clearing False Positive Cache

Sometimes Defender gets "stuck" on a specific file signature even after you've updated your code. If the error persists, you may need to force a signature update to clear the local detection cache.

# Navigate to the Defender utility folder
cd "C:\Program Files\Windows Defender"

# Wipe the current dynamic signature cache
.\MpCmdRun.exe -removedefinitions -dynamicsignatures

# Trigger an immediate update for new definitions
.\MpCmdRun.exe -SignatureUpdate

Verifying the Fix

Check these three things to ensure your environment is ready.

  • Verify Existence: Confirm the .exe actually returned to its folder. If it's missing, re-compile your code or re-download the tool.
  • Test via CLI: Run the file from a Command Prompt. If it launches without the "Operation did not complete" popup, your exclusion is active.
  • Audit Logs: Run Get-MpThreat in PowerShell. If the status for your file shows as 'Allowed' or the list is empty, you're in the clear.

Deep Dive

Related Error Notes