Backdoor:Win32/Multiverze!rfn Removal from computer even if quarantined

Open Windows Security → Virus & threat protection → Protection history, expand the Backdoor:Win32/Multiverze!rfn entry, and select Actions → Remove to delete the quarantined item permanently.

A quarantined threat is blocked and should not currently pose a risk, but it remains stored in quarantine until removed. Do not select Restore or Allow on device. Administrator privileges are required to view the detection details. ^1^

Complete the cleanup

1. Remove the quarantined item
   • Open Start → Windows Security.
   • Select Virus & threat protection → Protection history.
   • Expand the Backdoor:Win32/Multiverze!rfn detection.
   • Select Actions → Remove.
   • Restart Windows if prompted; some Defender remediation requires a reboot to finish. ^2^
2. Update Defender and run a full scan
   • Go to Windows Security → Virus & threat protection.
   • Under Virus & threat protection updates, select Protection updates → Check for updates.
   • Return to Virus & threat protection → Scan options.
   • Select Full scan → Scan now.
   Microsoft identifies this detection as a backdoor that can perform actions chosen by a malicious actor. Defender detects and removes it, but an infection can leave files or system changes behind; Microsoft therefore recommends current definitions and a full scan. ^3^
3. Run Microsoft Defender Offline
   • Save your work and close applications because the computer will restart.
   • Open Windows Security → Virus & threat protection → Scan options.
   • Select Microsoft Defender Antivirus (offline scan) → Scan now.
   • After Windows restarts and the scan finishes, check Windows Security → Protection history for the result.
   The offline scan runs in the Windows Recovery Environment without loading normal Windows, making it harder for persistent malware to hide or defend itself. ^4^ If BitLocker is enabled, have the recovery key available or suspend BitLocker first. Defender Offline also requires administrator rights and an enabled Windows Recovery Environment. ^5^
4. Remove the original infection source
   • Delete the download, ZIP archive, installer, email attachment, crack, or other file that produced the detection.
   • Empty the Recycle Bin.
   • Do not revisit or redownload from the originating site.

If Defender detects it again

A detection that returns shortly after restarting can indicate another hidden component is reinstalling it. Run Defender Offline again only if the first scan did not complete; otherwise, move to the next scanner rather than repeatedly quarantining the same item. ^6^

Download the latest Microsoft Safety Scanner, run a Full scan, and review its result. Its detailed log is stored at:

%SYSTEMROOT%\debug\msert.log

Safety Scanner is a manual malware-removal utility that can attempt to reverse changes made by identified threats. It expires 10 days after download, so obtain a fresh copy when scanning. ^7^

If the detection still returns, Defender reports Remediation incomplete, security settings become disabled, or unfamiliar startup processes persist, back up personal documents—not programs or installers—and reset/reinstall Windows. Do not use a fixlist.txt or FRST repair script written for another computer; those scripts are machine-specific. ^8^

Because this is classified as a backdoor, if the detected file was executed before quarantine, change important email, Microsoft, banking, and password-manager credentials from a different known-clean device, then enable multifactor authentication.

References

1. Protection History in the Windows Security App | Microsoft Support
2. Configure remediation for Microsoft Defender Antivirus detections
3. Backdoor:Win32/Multiverze!rfn threat description - Microsoft Security ...
4. Virus and Threat Protection in the Windows Security App | Microsoft Support
5. Microsoft Defender Offline scan in Windows - Microsoft Defender for ...
6. Troubleshoot problems with detecting and removing malware | Microsoft Support
7. Microsoft Safety Scanner Download - Microsoft Defender for Endpoint
8. My Windows Security shows a list of Threats that I can't remove, or fix. - Microsoft Q&A