How do I fix TrojanDownloader:JS/FakeUpdates.D?

Open Windows Security → Virus & threat protection → Protection history, expand the TrojanDownloader:JS/FakeUpdates.D entry, and apply the action shown there—normally Quarantine followed by Remove—rather than assuming the detection means the Trojan is still active.

1. Check Defender’s remediation status

Administrator privileges are required to view full threat details.

• Threat found – action needed: Select Actions → Quarantine. Do not select Allow on device unless Microsoft has confirmed a false positive.
• Threat quarantined: Select Remove. Quarantine blocks the item, but removal deletes it.
• Threat blocked: Defender reports that it blocked and removed the item; no additional action is required for that detection.
• Remediation incomplete: Expand the card and note the affected file path and additional instructions. Defender attempted cleanup but could not finish it.^1^

If the affected item is inside a .zip or another archive, delete the entire archive or right-click it and select Scan with Microsoft Defender. Defender may be unable to remediate an individual file while it remains inside a compressed archive.^2^

2. Update Defender and run a Full scan

1. Open Windows Security → Virus & threat protection.
2. Under Virus & threat protection updates, select Protection updates → Check for updates.
3. Under Virus & threat protection settings → Manage settings, ensure these are enabled:
   • Cloud-delivered protection
   • Automatic sample submission
4. Return to Virus & threat protection → Scan options.
5. Select Full scan → Scan now.

Microsoft recommends Defender Antivirus or Microsoft Safety Scanner for detecting and removing Trojans.^3^

3. If it returns, run Microsoft Defender Offline

Use this when the same detection reappears—particularly after restarting—or when remediation remains incomplete. Offline scanning runs outside normal Windows, which can expose malware that hides or reinstalls itself while Windows is running.^4^

1. Save all work; the computer will restart.
2. Open Windows Security → Virus & threat protection → Scan options.
3. Select Microsoft Defender Offline scan → Scan now.
4. After Windows restarts, review Protection history again.

If BitLocker protects the system drive, Microsoft recommends suspending BitLocker before the offline scan to avoid a recovery-key prompt.^5^ Suspending it temporarily reduces drive protection, so resume BitLocker immediately after the scan and restart; alternatively, ensure the recovery key is available before proceeding.

Defender Offline does not apply to Windows on ARM or Windows Server. It also requires local administrator privileges and Windows Recovery Environment (WinRE). If selecting the scan appears to do nothing, open Command Prompt as administrator and check:

reagentc /info

If the result says Disabled, enable WinRE and retry:

reagentc /enable

4. If Defender still cannot complete cleanup

Download a fresh copy of Microsoft Safety Scanner, select the version matching 32-bit or 64-bit Windows, and run a Full scan. The scanner is manually triggered, expires 10 days after download, and records detailed results in %SYSTEMROOT%\debug\msert.log.^6^

If both Defender Offline and Safety Scanner continue finding the same item, record:

• Detection status and affected path from Protection History
• Whether it returns immediately after restart
• Safety Scanner’s msert.log result

Seek Microsoft Support or qualified malware-removal assistance with those details. Reset or reinstall Windows only as a last resort when repeated cleanup fails and there is evidence of persistent compromise or irreversible system changes; back up personal files first, preferably from a backup created before the infection.^4^

References

1. Protection History in the Windows Security App | Microsoft Support
2. Troubleshoot Windows Defender or Endpoint Protection client
3. Trojan malware - Microsoft Defender for Endpoint
4. Troubleshoot problems with detecting and removing malware | Microsoft Support
5. Run and review the results of a Microsoft Defender Offline scan
6. Microsoft Safety Scanner Download