Microsoft Defender repeatedly detects Trojan:Win32/Commando.A!ml on my laptop, even though it says the threat was blocked. The alert points to this command: C:WindowsPowerShellv1.0powershell.exe -ep bypass -w h C:ProgramDataburst.bat. I did not intentionally download anything today; I only turned on the computer and played some games. The warning now appears about once a minute. I already ran a full Microsoft Defender Offline scan and put the laptop in Airplane Mode as a precaution. What might be causing this, and can I remove it without wiping the computer?
1 Answer
The repeated alerts suggest something on the system is repeatedly launching that batch file, possibly through a scheduled task, startup entry, or another persistence mechanism. The command uses PowerShell with execution-policy bypass and runs C:ProgramDataburst.bat, so treat it as suspicious. Keep the laptop offline, do not run the batch file, and check Defender's protection history for the exact detected file and action. You can also inspect Task Scheduler and startup items for anything launching burst.bat, then run updated Defender scans and a second-opinion malware scanner. If the file or persistence mechanism cannot be removed safely, back up only personal documents and consider resetting Windows rather than risking continued infection.
I suspected it was malicious, but I couldn't find burst.bat at the path shown in the alert. Is there a way to remove it without doing a complete reset?