Trojan:MSIL/Heracles.ARA!MTB threat occurring after restarting/starting the PC

Treat this as a potentially active startup infection unless Protection History shows only the same old event timestamp; do not delete or allow MSBuild.exe, and use Microsoft Safety Scanner plus Autoruns to identify what launches it.

1. Determine whether this is a new detection

Open Windows Security → Virus & threat protection → Protection history, expand the Heracles entry, and compare:

• Detected time: If it changes after each restart, Defender is detecting fresh activity. Deleting Protection History does not remove the process or startup mechanism causing it.
• Status:
  • Threat blocked: Defender blocked and removed that instance.
  • Threat quarantined: Select Remove.
  • Threat found – action needed: Select Quarantine, not Allow on device.
  • Remediation incomplete: Expand the card and complete the requested action.

Protection History normally retains events for two weeks. Therefore, an unchanged historical timestamp alone does not show that the threat is currently running; a new timestamp after every boot does. Administrator privileges are required to view full details.^1^

The amsi: prefix means the detection came through the Anti-malware Scan Interface, which can inspect scripts and memory-based .NET activity. It does not, by itself, establish that the legitimate framework copy of MSBuild.exe has been replaced.^2^

2. Run a different Microsoft removal engine

Since full and Defender Offline scans have already been completed, do not repeat them now.

1. Disconnect the PC from the network.
2. From a known-clean device if possible, download the latest Microsoft Safety Scanner.
3. Transfer it to the affected PC, run msert.exe as administrator, and select Full scan.
4. Review the result and then inspect: %SYSTEMROOT%\debug\msert.log
5. Restart and check whether Protection History records a new event.

Safety Scanner is an on-demand Microsoft malware-removal tool. It expires 10 days after download, so use a newly downloaded copy.^3^

3. Inspect the boot-time launcher

If a new detection appears after restart, something may still be launching suspicious content through MSBuild. Microsoft documents that recurring malware can result from an undetected component reinstalling or invoking it after restart.^4^

Use Microsoft Sysinternals Autoruns:

1. Download and extract Autoruns from Microsoft.
2. Right-click Autoruns64.exe or Autoruns.exe and select Run as administrator.
3. Under Options, enable:
   • Verify Code Signatures
   • Hide Signed Microsoft Entries
4. Press F5 to refresh.
5. Search with Ctrl+F for:
   • MSBuild
   • .proj
   • PowerShell
   • cmd.exe
   • paths under %TEMP%, %AppData%, or %ProgramData%
6. Examine Logon, Scheduled Tasks, Services, WMI, and Boot Execute.
7. For a suspicious entry, use Jump to Entry or Jump to Image and record its command, publisher, and location.
8. Uncheck a suspicious third-party entry to disable it temporarily. Do not immediately delete it.
9. Restart and check whether a new detection occurs.

Autoruns covers startup folders, Run keys, scheduled tasks, services, WMI-related entries, and other auto-start locations. Unchecking an entry disables it reversibly; deleting it removes its startup configuration.^5^

Do not remove:

\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe

Instead, identify the command line, project/script, scheduled task, service, or WMI entry that invokes it. Custom FRST “fixlist” scripts from similar cases must not be reused: those scripts were written for specific computers and can damage another installation.^6^

4. If nothing suspicious is found

• If no new timestamp appears after reboot, it was likely an old Protection History record; allow it to age out naturally.
• If a new detection appears but both Microsoft scanners find nothing, submit the actually detected payload or related project/script—not a trusted Windows component—to Microsoft for classification.^7^
• If the detection continues and its launcher cannot be identified, back up personal documents only and reset/reinstall Windows. Restore files from a backup created before the original compromise where possible; local backups present during an infection may also have been modified.^4^

After cleanup, use another trusted device to change passwords for email, Microsoft, banking, and other important accounts, and review their recent sign-in activity.

References

1. Protection History in the Windows Security App | Microsoft Support
2. Anti-malware Scan Interface integration with Microsoft Defender Antivirus
3. Microsoft Safety Scanner Download
4. Troubleshoot problems with detecting and removing malware | Microsoft Support
5. Autoruns v14.3
6. MSBuild.exe contacting an unknown website every 10 minutes - Microsoft Q&A
7. Submit a file for malware analysis - Microsoft Security Intelligence