Trojan keeps being detected by windows security

If the same trojan is detected again after removal, the supported next step is to treat it as recurring malware and run Microsoft Defender Offline again, then verify Defender is fully updated and its advanced protection features are enabled.

1. Turn on Defender’s strongest detection settings:
   • Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   • Under Virus & threat protection settings, select Manage settings.
   • Make sure Cloud-delivered protection and Automatic sample submission are On.
2. Update Microsoft Defender Antivirus before scanning:
   • Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   • Under Virus & threat protection updates, select Check for updates.
   • Under Threat definitions, select Check for updates.
3. Run Microsoft Defender Offline again because recurring detections after restart can mean a hidden component is reinstalling the malware:
   • Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   • Under Current threats, select Scan options.
   • Select Windows Defender Offline scan or Microsoft Defender Antivirus (offline scan), then select Scan now.
   • Save open files first. This scan restarts the PC and runs outside Windows so hidden malware has less chance to defend itself.
4. After the offline scan finishes, check Protection history in Windows Security to review what was found and what action was taken.
5. If scans are slow or incomplete, make sure there is enough free space on the system drive and close other apps before scanning. A restart and then scanning before opening other apps can help.
6. If suspicious files still are not being properly detected, submit the files to Microsoft for analysis.
7. If the malware keeps returning even after offline scanning, avoid revisiting the site or file source that introduced it. Re-detection can happen if the same malicious file is downloaded again or if a hidden component is reinstalling it.
8. If the infection has caused irreversible system changes, back up needed files carefully and consider resetting the PC. This can require restoring data from backups. Use backups created before the infection when possible, because backups stored on the PC during infection might also have been modified.

For the account compromise side of the issue, trojans can steal passwords and sign-in details. Secure the Microsoft account and any other accounts used on that PC from a known-clean device.

• Troubleshoot problems with detecting and removing malware
• Troubleshoot problems with detecting and removing malware
• Troubleshoot problems with detecting and removing malware
• Virus and Threat Protection in the Windows Security App
• Trojans
• Troubleshoot problems with detecting and removing malware