Microsoft Defender repeatedly reports Trojan:Win32/Commando.A!ml, apparently associated with `C:WindowsPowerShellv1.0powershell.exe -ep bypass -w h C:ProgramDataburst.bat`. The alert returns about once a minute even though Defender says it blocked the threat. I did not knowingly download anything today; I only started the laptop and played games. A full Microsoft Defender Offline scan has already been completed, and the laptop is currently in Airplane mode. What could be causing the repeated detection, and can I remove it without resetting Windows?
2 Answers
The fact that the alert repeats usually means something is recreating or repeatedly launching the file; it does not necessarily mean Defender failed to block every attempt. Check the exact detection details and quarantine status, then use Windows Security's scan options and run a second Offline scan after updating Defender definitions. Do not restore or allow the detected item. If the file is absent, the trigger may be a scheduled task or startup command rather than the batch file itself. Disconnecting from the network is sensible while investigating, and change important passwords from a separate clean device if you confirm the malware executed.
That command strongly suggests a script is being launched repeatedly by a scheduled task, startup entry, or another persistence mechanism. Treat it as a real compromise until proven otherwise. Keep the laptop offline, do not run `burst.bat`, and check Defender's Protection History to see whether it quarantined the script or only blocked the process. You can also inspect Task Scheduler, Startup Apps, and the `C:ProgramData` folder using an administrator account. Autoruns from Microsoft's Sysinternals tools can help locate entries that launch PowerShell. Remove the malicious persistence entry and run another Offline scan, followed by a full scan. If Defender cannot clean it or you find multiple suspicious changes, backing up only personal documents and reinstalling Windows is safer than trying to guess what was modified.
I was hoping to avoid a reset, but I’ll keep it disconnected and check the scheduled tasks and Defender history before doing anything else.