Defender quarantined a file you need: verify before restoring

A quarantined file is contained, not silently deleted. Restoring it can put it back where the app can run; allowing it may also weaken future protection. This matters most when a game mod, tool or installer was downloaded from an unofficial mirror. Do not restore just because a program refuses to open.

A careful decision path​

1. In Windows Security → Virus & threat protection → Protection history, open the detection. Record its name, exact file path and the action already taken. Check whether this is the file you intended to use.
2. Find the publisher's official download or release page from an independent bookmark or search you inspect carefully. Compare version, filename and any published digital signature or checksum. If the file came from a repack, cracked installer or message attachment, do not assume it matches the official build.
3. If the publisher considers the detection incorrect, look for its own explanation and submit the sample through Microsoft's official channel when appropriate. Wait for a determination if you can; avoid adding a broad folder exclusion.
4. Only if you have strong evidence and accept the risk should you consider Restore or Allow. Afterward, rescan and remove the exception when it is no longer needed. If you cannot verify it, leave it in quarantine or remove it.

Understand the two buttons​

Microsoft explains that Restore returns a quarantined file to its location and Defender may detect it again. Allow on device permits a file that you have decided is safe. Neither button proves the file harmless. See Microsoft's action descriptions and our checksum-versus-signature guide. If sensitive accounts were used after running the file, protect them from another trusted device.