how to remove VirTool:PowerShell/MaleficAms.W

Question

virus alert as above on starting which windows security seems to catch and quarantine each time, I have also completely removed powershell from my windows install and it still appears any help appreciated

Answer 1

Please share your Farbar scan logs for analysis.

• Download Farbar Recovery Scan Tool 64-bit FRST64.exe
• If the OS language is not English, rename FRST64.exe to FRST64English.exe.
• Run the program. Don't check or uncheck any options. Click "Scan".
• Add the two logs, FRST.txt and Addition.txt, to a zip archive.
• Share the zip file on OneDrive or GoFile.io, and post the link here.

---

Note: If Microsoft Edge or Chrome mislabels the Farbar Scanner executable as PUA/malware, choose to keep it by tapping … in the bottom bar, choosing Keep, and then choosing Keep anyway in the dialog that appears. See this screenshot. It's a safe tool used in most antimalware forums.

---

Answer 2

Since Windows Security is detecting and quarantining it at startup every time, the likely issue is a recurring malware component or startup mechanism that is reinstalling or relaunching the threat.

Recommended cleanup path:

1. Run a Microsoft Defender Offline scan.
   • Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   • Under Current threats, select Scan options.
   • Select Windows Defender Offline scan and then Scan now.
   • Important: save work first, because the PC will restart before the scan starts.
2. After Windows restarts, review what Defender found.
   • Go to Start > Settings > Update & Security > Windows Security > Virus & threat protection.
   • Under Current threats, select Threat history.
   • Under Quarantined threats, select See full history.
   • For detected items, use Remove to delete them. Leave them quarantined if not certain they are safe. A quarantined file does not pose a risk while it remains in quarantine.
3. Run the Malicious Software Removal Tool if Defender reports the threat was only partially removed.
   • Press Windows logo key + R.
   • Run: %windir%\system32\mrt.exe
   • Allow it to make changes if prompted, then follow the prompts to scan and clean the PC.
4. Restart the PC and install the latest Windows updates.
   • Security updates are delivered through Windows Update and help close malware-related gaps.
5. If another antivirus or antispyware product is installed, uninstall it unless it is intentionally being used.
   • Go to Start > Settings > Apps.
   • Select the unwanted security app and choose Uninstall.
   • Caution: removing security software leaves the PC temporarily unprotected unless Microsoft Defender Antivirus is enabled and Windows Firewall is on.
6. If the same detection still returns after reboot, avoid revisiting any site or file source that may be reintroducing it.
   • Repeated detection can happen if the malware is being downloaded again or if a hidden component is restoring it.

About PowerShell removal: removing PowerShell does not by itself remove malware persistence. If the threat is triggered at startup, the cause is more likely a remaining malicious component than PowerShell itself.

If Windows Security shows Threat found - action needed, choose Quarantine unless the file is fully trusted. Allow on device should only be used for software that is known to be safe.

---

References:

• Troubleshoot problems with detecting and removing malware
• Antivirus and antimalware software: FAQ
• Protect my PC from viruses
• Protection History in the Windows Security App