Treat the device as potentially compromised, preserve Defender’s detection details, and complete quarantine/removal plus a Microsoft Defender Offline scan before reconnecting it or restoring normal use.

1. Contain and preserve evidence

1. Disconnect the PC from Ethernet, Wi-Fi, VPN, and shared storage. Do not sign in to sensitive accounts from it.
2. Open Windows Security → Virus & threat protection → Protection history.
3. Expand the Trojan:Win64/Malgent!MSR entry and record:
   • Status and action taken
   • Affected file path
   • Detection time
   • Severity
   • Any process or error information
4. Do not select Allow, restore the item, add an exclusion, or execute/upload it to public multiscanner services. Defender’s supported remediation actions are Clean, Quarantine, or Remove; Allow does not remediate the threat.^1^
5. If Defender requests a restart, save work and restart. Some remediations are not complete until after reboot.^1^

The detection name establishes that Defender classified an artifact as a trojan; it does not, by itself, reveal the exact payload or prove which credentials or files were accessed. Trojans can download additional malware, collect credentials or browsing information, or provide remote control, so investigate the affected artifact and surrounding activity rather than inferring behavior from the label alone.^2^

2. Complete remediation

Temporarily reconnect only long enough to update Defender:

1. Open Windows Security → Virus & threat protection → Protection updates → Check for updates.
2. Under Virus & threat protection settings → Manage settings, verify Cloud-delivered protection, Automatic sample submission, and Tamper protection are enabled.
3. Return to Scan options, select Full scan, and start it.
4. Then select Microsoft Defender Antivirus (offline scan) → Scan now. Save open files first: the PC restarts into Windows Recovery Environment, scans without loading normal Windows, and restarts again. Review the result in Protection history.^3^

If Defender still reports the item, download a fresh copy of Microsoft Safety Scanner on a clean computer, transfer it using removable media, and run a full scan. Its detailed log is %SYSTEMROOT%\debug\msert.log; the scanner expires ten days after download and does not replace Defender.^4^

Do not use a generic FRST “fixlist” from another incident. Such scripts are machine-specific and can remove legitimate tasks, services, or files.

3. Determine what was affected

For a standalone Windows PC, inspect Defender’s operational log:

1. Open Event Viewer.
2. Go to Applications and Services Logs → Microsoft → Windows → Windows Defender → Operational.
3. Filter around the detection time for:
   • 1116 — malware detected
   • 1117 — remediation action taken
   • 1118 — action failed
   • 1119 — action critically failed
4. Record the threat ID, path, process name, detection source/type, action, error code, signature version, and engine version. These fields identify the local artifact and whether remediation succeeded.^5^

Also examine activity at and shortly before the detection time:

• Recently installed applications and browser extensions
• Downloads and email attachments
• Newly created scheduled tasks, services, startup entries, or Defender exclusions
• Unexpected outbound connections
• Additional files created by the detected process

If the device is onboarded to Microsoft Defender for Endpoint, open its device page and use the Timeline to filter around the detection. Event details can show whether remediation succeeded and related entities; Hunt for related events can pivot to surrounding activity.^6^

4. Analyze the sample safely

Do not run or unpack the suspected file on the affected PC. For authoritative analysis:

1. Keep Defender’s quarantined copy quarantined.
2. If an accessible copy exists, submit it through Microsoft’s sample submission portal and select the option indicating that the file may contain malware.
3. Include the detection name, original path, detection time, source/download context, and observed behavior.
4. Record the Submission ID and track the result after signing in. Microsoft accepts samples through the portal, not by email.^7^

Dynamic payload analysis should be performed only in a purpose-built, isolated malware-analysis environment with no production credentials, shared clipboard, shared folders, or access to organizational networks. If such a lab is unavailable, submit the sample to Microsoft or engage an incident-response provider instead.

5. Recover securely

After scans report clean and the detection does not return after another reboot:

• From a different clean device, change passwords for accounts used on the affected PC, prioritizing email, Microsoft accounts, financial services, VPN, and administrative accounts. Revoke active sessions and enable multifactor authentication.
• Install Windows and application updates.
• Restore documents only from a backup created before the suspected infection; scan restored data before opening it.

If remediation fails, the detection returns, unknown administrator-level persistence remains, or sensitive credentials were used while the trojan might have been active, back up documents—not executables or scripts—and perform a clean Windows installation from installation media. This removes files, applications, and settings from the selected drive and is Microsoft’s supported recovery path when malware persists.^8^

References

1. Configure remediation for Microsoft Defender Antivirus detections
2. Trojans
3. Virus and Threat Protection in the Windows Security App
4. Microsoft Safety Scanner Download
5. Review event logs and error codes to troubleshoot issues with Microsoft Defender Antivirus
6. Investigate devices in Microsoft Defender for Endpoint
7. Submit files for analysis
8. Recovery options in Windows | Microsoft Support