How to completely remove Trojan:Win32/PowerBypass.DA!MTB Detected by Microsoft Defender Antivirus

Question

Defender Antivirus detects and removes after every scan. Why doesn't it completely remove all remnants?

Answer 1

Please share your Farbar scan logs for analysis.

• Download Farbar Recovery Scan Tool 64-bit FRST64.exe
• If the OS language is not English, rename FRST64.exe to FRST64English.exe.
• Run the program. Don't check or uncheck any options. Click "Scan".
• Add the two logs, FRST.txt and Addition.txt, to a zip archive.
• Share the zip file on OneDrive or GoFile.io, and post the link here.

---

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot. It's a safe tool used in most antimalware forums.

---

Answer 2

Microsoft Defender Antivirus can report a threat as not fully removed when it cleaned some malicious components but not all of them. This commonly happens when:

• there is not enough free disk space to quarantine or remove files
• the threat is inside a compressed archive such as a .zip
• the threat is on a network share
• remediation requires a reboot to finish all cleanup steps

A practical cleanup path is:

1. Restart the PC first
   Some remediation actions are only completed after reboot. Even if the detection is later found to be a false positive, the reboot must be completed for all remediation steps to finish.
2. Make sure Microsoft Defender is fully updated
   Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   Under Virus & threat protection updates, select Check for updates, then under Threat definitions, select Check for updates.
3. Turn on cloud-based protection features
   Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection > Manage settings.
   Make sure Cloud-delivered protection and Automatic sample submission are On.
4. Run a full scan
   If the source is unclear, run a full scan. Full scans can take a long time, especially on large disks or when many archive files are present.
5. Run the Malicious Software Removal Tool
   Press Windows logo key + R, type %windir%\system32\mrt.exe, select OK, allow it to run, and follow the prompts to scan and clean the PC.
6. Check for files Defender cannot remediate directly
   If the detection is in a compressed archive, browse to that file and either delete it or right-click it and select Scan with Windows Defender.
   If the detection is on a network share, open the share and manually scan the file there.
7. Ensure enough free disk space exists
   Defender needs disk space to quarantine and remove malware. Low free space, especially on drive C, can prevent complete remediation.
8. Install the latest Windows updates
   After cleanup, restart and manually install the latest updates.

If suspicious files still are not detected or continue to reappear after these steps, submit the files to Microsoft for analysis.

---

• Configure remediation for Microsoft Defender Antivirus detections
• Antivirus and antimalware software: FAQ
• Troubleshoot problems with detecting and removing malware
• Troubleshoot problems with detecting and removing malware
• Troubleshoot problems with detecting and removing malware
• Troubleshoot Windows Defender or Endpoint Protection client