The virus is not clearing up

Run Microsoft Defender Offline now because it scans outside normal Windows, where persistent malware cannot interfere as easily with removal. ^1^

1. Contain and scan the PC offline

1. Disconnect the PC from Wi-Fi or Ethernet. Do not use it for email, banking, shopping, or password changes until it is clean.
2. Save open documents and close all applications—the offline scan restarts the PC.
3. If device encryption or BitLocker is enabled, have the recovery key available. Microsoft advises suspending BitLocker before this scan; otherwise, Windows might request that key during restart.
4. Open Windows Security → Virus & threat protection → Scan options.
5. Select Microsoft Defender Offline scan → Scan now → Yes.
6. Allow the PC to restart, scan, and return to Windows. The scan normally runs in an isolated environment and then restarts Windows. ^2^

If the button does nothing, open Terminal/PowerShell as administrator and check that Windows Recovery Environment is enabled:

reagentc /info
reagentc /enable
Start-MpWDOScan

Run reagentc /enable only if the first command reports Windows RE status: Disabled. The final command immediately restarts the computer. Defender Offline requires administrator rights and an enabled Windows Recovery Environment. ^2^

2. Verify removal after Windows starts

1. Reconnect to the internet.
2. Run Settings → Windows Update → Check for updates, install everything offered, and restart.
3. Open Windows Security → Virus & threat protection → Protection updates → Check for updates.
4. Go to Scan options, select Full scan, and run it with other programs closed.
5. Review Windows Security → Virus & threat protection → Protection history. Do not select Allow or Restore for the detection.

If Defender still reports incomplete removal, run Microsoft’s built-in Malicious Software Removal Tool:

1. Press Windows key + R.
2. Enter %windir%\system32\mrt.exe.
3. Select Yes → Next → Full scan and apply any recommended cleanup.
4. Restart, update Windows again, and repeat the Defender Offline scan.

Microsoft specifically recommends an MRT full scan, restart, updates, and—when additional cleanup is required—Microsoft Defender Offline for partially removed threats. ^3^

If Protection History identifies the affected item as a downloaded ZIP or other compressed archive, delete that entire archive and empty the Recycle Bin; Defender may be unable to remediate an individual threat stored inside an archive. ^4^

3. If freezing or detections continue

Do not use an unreviewed FRST “fixlist” made for somebody else. Those scripts are specific to the exact files, tasks, and registry entries on one computer.

Back up only personal documents and photos—not downloaded installers, scripts, executables, ZIP files, or browser extensions. If Defender Offline cannot remove the infection, the same threat returns, or Windows continues crashing, reinstall Windows from installation media created on another clean PC. This removes everything, so verify the backup first. Microsoft identifies reinstalling from installation media as the recovery option when malware infection is suspected or other recovery methods fail. ^5^

After reinstalling:

• Install all Windows updates before restoring files.
• Restore from a backup created before the incident where possible; backups present during infection may have been modified. ^1^
• From a different, known-clean device, change passwords used on the affected PC and enable multifactor authentication.
• Do not revisit the website that initiated the downloads.

References

1. Troubleshoot problems with detecting and removing malware | Microsoft Support
2. Run and review the results of a Microsoft Defender Offline scan
3. Antivirus and antimalware software: FAQ | Microsoft Support
4. Troubleshoot Windows Defender or Endpoint Protection client
5. Recovery options in Windows