I installed the latest quality and security updates through the Windows Update application, which confirmed that my device was up to date. Despite this, Windows Security prompted me to perform a scan under Virus and Threat Protection. A quick scan detected a Trojan threat and moved it to the quarantine folder. I then ran a Microsoft Defender offline scan, which returned clean results. Following that, I performed a full Microsoft Defender scan, which flagged the same threat already quarantined after the initial quick scan. To ensure system integrity and address the vulnerability, I executed a full-mode scan using the Windows Malicious Software Removal Tool, and the results came back clean. Trojan threat is likely hiding in a specific file archive, system restore point, or a non-active data folder that quick and Microsoft Defender offline scans skip.
To remove Trojan threat:
1. Run a Full Microsoft Defender Scan
You need the Full Scan to pinpoint the exact file path.
Go to Settings > Privacy & security > Windows Security.
Click Virus & threat protection > Scan options.
Select Full scan and click Scan now.
2. Run the Windows Malicious Software Removal Tool (MSRT Full Mode)
Press Win + R, type mrt, and hit Enter. Select Full scan. This specifically looks for the most prevalent high-severity families of malware and can sometimes catch things Defender handles differently.
3. Clear the Detection History
If the Trojan persists in scans despite using the Removal Tool and Offline scans, your Windows Security history might be corrupted, causing ghost detections.
- Navigate to: C:\ProgramData\Microsoft\Windows Defender\Scans\History\Service
- Delete the Detection History folder.
- Restart your PC and run a Quick Scan to see if the notification clears.