How to remove totally, Trojan:Win32/HeavensGate.RPY!MTB from my computer?

Microsoft Defender detects and removes Trojan:Win32/HeavensGate.RPY!MTB, but Microsoft recommends updating its security intelligence and running a full scan to clean up possible remnant files or system changes.^1^

Remove and verify it

1. Disconnect the PC from the Internet temporarily.
   • Turn off Wi-Fi or unplug Ethernet.
   • Do not open the detected file or sign in to sensitive accounts during cleanup.
2. Update Microsoft Defender.
   • Open Windows Security.
   • Select Virus & threat protection.
   • Under Virus & threat protection updates, select Protection updates → Check for updates.
3. Remove the current detection.
   • Go to Windows Security → Virus & threat protection → Protection history.
   • Open the entry for Trojan:Win32/HeavensGate.RPY!MTB.
   • Select Remove or Quarantine, then Start actions if displayed.
   • If it appears under Allowed threats, select it and choose Don’t allow. Defender cannot act on a threat while it remains allowed.^2^
4. Run a Full scan.
   • Go to Virus & threat protection → Scan options → Full scan → Scan now.
   • Allow Defender to remove or quarantine everything it detects. A full scan checks every file and program on the device.^2^
5. Run Microsoft Defender Offline.
   • Save all open work because the computer will restart.
   • Go to Virus & threat protection → Scan options.
   • Select Microsoft Defender Antivirus (offline scan) → Scan now.
   • Windows restarts and scans without loading normal Windows, making persistent malware more difficult to hide.^3^
   • After Windows restarts, check Windows Security → Virus & threat protection → Protection history for the result.
   If BitLocker is enabled, have the recovery key available before starting. On x64 Windows 11, Microsoft also documents suspending BitLocker first to avoid a recovery-key prompt. The documented Defender Offline scan does not apply to Windows 11 on ARM.^4^
6. Reconnect and run Windows Update.
   • Open Settings → Windows Update → Check for updates.
   • Install available Windows and security updates, restart, and run one more Defender Full scan.

If the same detection returns

A repeated detection can mean that another hidden component is reinstalling it, or that the PC is being exposed again through the same download, website, email attachment, archive, or removable drive. Microsoft specifically recommends Defender Offline when malware keeps returning.^5^

Also run a second Microsoft scan:

1. Download the current 64-bit Microsoft Safety Scanner unless the PC uses 32-bit Windows.
2. Open the downloaded msert.exe and select Full scan.
3. Review the displayed results; detailed results are stored in %SYSTEMROOT%\debug\msert.log.

Safety Scanner can remove malware and reverse some changes, but it expires ten days after download and does not replace Defender’s real-time protection.^6^

Do not add the detected file or folder to Defender exclusions. Delete the original installer, archive, email attachment, or download that introduced it, and scan connected USB drives before reopening their files.

If cleanup still fails

• Ensure drive C: has sufficient free space; Defender may be unable to quarantine or completely remove malware when disk space is insufficient.^7^
• If Defender or Safety Scanner still detects the threat after rebooting, back up personal documents—but not unknown executables, scripts, installers, or archives—and use Settings → System → Recovery → Reset PC. Remove everything is the safer reset choice after a persistent compromise, but it erases applications and data.
• From a different, known-clean device, change passwords for email, banking, Microsoft, and other important accounts if they were used after the suspected infection. Enable multifactor authentication and review recent account activity. Trojans can capture sign-in information or give an attacker control of the device.^8^

References

1. Trojan:Win32/HeavensGate.RPY!MTB - microsoft.com
2. Virus and Threat Protection in the Windows Security App | Microsoft Support
3. Three easy steps to improve your cybersecurity | Microsoft Support
4. Run and review the results of a Microsoft Defender Offline scan
5. Troubleshoot problems with detecting and removing malware | Microsoft Support
6. Microsoft Safety Scanner Download
7. Troubleshoot problems with detecting and removing malware
8. Trojans