Windows Defender keeps discovering Trojan:JS/Obfuse.NF!MTB in affected item powershell.exe

The repeated detections indicate a persistent component that keeps launching PowerShell with a malicious command. Standard scans alone are often not enough; additional cleanup and an offline scan are required.

Use the following steps:

1. Run Microsoft Defender Offline
   • This targets hidden components that reinstall the malware after cleanup.
   • In Windows, select Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   • Under Current threats, select Scan options.
   • Select Windows Defender Offline scan and then Scan now.
   • The PC will restart and perform the offline scan; let it complete and apply all actions.
2. Remove any remaining detected threats
   • After the offline scan and reboot, open an elevated PowerShell window (Run as administrator).
   • Run the Defender cleanup cmdlet to remove any active threats that are still registered:

          Remove-MpThreat
     

   • This removes all active threats that Microsoft Defender has detected on the computer.
3. Manually remove or rescan the source file if identified
   • If Defender reports the threat inside a specific file (for example, a compressed archive or a file on a network share), browse to that file location.
   • Delete the file, or right‑click it and select Scan with Microsoft Defender.
   • If additional threats are detected in that file or location, choose the remediation action offered by Defender.
4. Keep Windows and Defender fully updated
   • Run Windows Update to ensure the latest Defender engine and security intelligence are installed. This can fix issues where components fail to remove or detect all parts of the malware.
5. Avoid reinfection
   • Do not revisit any suspicious websites or re‑run any installers that were in use when the infection started, especially from mirror or unofficial download sites.
   • Use a modern browser such as Microsoft Edge with Microsoft Defender SmartScreen enabled to block known malicious sites.

If the malware continues to reappear even after the offline scan and Remove-MpThreat, collect logs and consider engaging Microsoft support for deeper investigation.

References:

• Troubleshoot problems with detecting and removing malware
• Troubleshoot Windows Defender or Endpoint Protection client
• Remove-MpThreat