Step-by-step cleanup of a Trojan that adds Windows Defender exceptions

A Trojan can quietly weaken Microsoft Defender by adding exclusions for a malicious file, folder, process or extension. Once those exceptions are in place, the suspicious item may be scanned less aggressively or skipped. Symptoms include repeated alerts, a disabled security pane, or files returning after deletion, which can resemble an ordinary Windows fault.

Cleanup has two linked stages: remove the Trojan and its persistence, then remove only the Defender exclusions added maliciously. Reversing that order gives the malware another opening. Record suspicious paths and processes first, because an administrator or trusted application may have created legitimate exclusions.

Use a known-clean administrator account where possible, and avoid moving unknown executables, scripts or archived installers to another device. Random “Defender fix” utilities can install fresh exclusions. A second scan is useful only after the malware, persistence mechanisms and unauthorised exceptions have been addressed.

Australian conditions add common complications. Commuters in Sydney, Melbourne and Brisbane often switch between home Wi-Fi, mobile hotspots and café Wi-Fi, while one Windows laptop may handle work email, banking and household accounts. Second-hand PCs sold through Gumtree Australia or local dealers may retain old exclusions, remote-access software and previous-owner accounts.

Method	Best for	Main limitation
Windows Security exclusions screen	Quick visual review and removal	May not display every process, extension or address category
Elevated PowerShell	Precise inspection and removal of named exclusions	Incorrect values can remove trusted configuration
Offline scan and Autoruns	Removing malware and startup persistence	Neither repairs Defender configuration by itself
Administrator or IT support	Work or school devices governed by policy	Requires authorisation and may take longer

Recognise altered Defender settings

Open Windows Security from the Start menu, select Virus & threat protection, then choose Manage settings. Under Exclusions, select Add or remove exclusions and record unfamiliar entries. Paths under AppData, Temp, ProgramData, Downloads or removable drives deserve attention, although location alone does not prove malware; game launchers and development software can create valid exceptions.

Compare the list with recent software installations, browser extensions, scheduled tasks and startup entries. An unexplained exclusion pointing to a script, cracked utility or unfamiliar executable is stronger evidence than a broad folder entry. Do not delete an exclusion until you know what it protects.

For broader symptoms and removal patterns, the site’s Trojan removal guidance can help distinguish a one-off malicious program from an implant designed to persist.

Disconnect and contain the infection

Disconnect the PC from Ethernet and turn off Wi-Fi, mobile data and any virtual private network connection. Do not reconnect until the malware and its persistence mechanisms have been removed. Keeping the computer powered on is helpful if it remains stable, but disconnect and shut it down if it is overheating or behaving erratically.

Before deleting anything, copy ordinary documents and photographs to clean storage. Exclude executables, scripts, browser profiles and unknown archives because they may carry the infection again. A written inventory of suspicious filenames, processes and folders will also make it easier to check for surviving components.

Use a separate clean device to change important passwords, revoke active sessions and contact financial institutions if banking activity appears unfamiliar. Do not access cryptocurrency accounts or enter recovery phrases on the potentially infected machine.

Remove the Trojan and its persistence

Open Apps & features in Windows Settings and uninstall programs that you did not install or recognise. Then run a Microsoft Defender full scan, followed by a Microsoft Defender Offline scan when a persistent Trojan is suspected. These scans can remove quarantined components, but they may not reach malware protected by startup tasks or a broken security configuration.

Microsoft Sysinternals Autoruns can expose startup folders, Run keys, services and scheduled tasks. Review each unfamiliar entry before disabling it, and use Autoruns’ built-in scan option to identify suspicious files. If normal Windows access is blocked, restart into Safe Mode with networking disabled and repeat the scan before reconnecting.

If the Trojan also reads the clipboard or replaces cryptocurrency addresses, follow the linked clipboard spyware cleanup guidance, since removing a Defender exception does not remove a separate spyware implant.

Clear the injected exclusions

Open Windows Terminal or PowerShell as administrator and run Get-MpPreference | Format-List ExclusionPath, ExclusionProcess, ExclusionExtension, ExclusionIpAddress. Compare the results with your recorded findings. Hidden or recently introduced paths are likely candidates, while exclusions matching workplace policy should remain untouched.

Remove confirmed malicious values with the matching Remove-MpPreference command. Examples include Remove-MpPreference -ExclusionPath "C:\Users\Name\AppData\Local\Temp\SuspiciousFolder" and Remove-MpPreference -ExclusionProcess "C:\ProgramData\suspect.exe". Replace these examples with the exact displayed values, and remove an extension or address exclusion only when you have confirmed it was injected.

If a command fails, check Group Policy, tamper protection and whether Defender’s service has been stopped. Do not blindly disable security controls or overwrite organisational settings. A managed work or school computer may require its IT administrator to clear the exclusions under the organisation’s approved process.

Verify recovery and reduce recurrence

Reboot into normal Windows, install current security updates and run another full scan. Check the Windows Security exclusions screen and repeat the PowerShell inspection. A successful cleanup should produce no unexplained exclusions, no suspicious startup entries and no recurrence of the original alert or file behaviour.

Treat the incident as a possible credential theft. Change passwords from a clean device, enable multi-factor authentication and review email forwarding rules, password resets and active sessions. Businesses must assess suspected personal-data breaches under the Australian Privacy Act 1988 and the Notifiable Data Breaches scheme administered by the Office of the Australian Information Commissioner.

Bring BYOD and second-hand devices under a managed update and endpoint-protection policy, and avoid remote-access software from unverified sources. The Australian Signals Directorate’s Essential Eight and the Australian Cyber Security Centre’s ReportCyber service provide useful guidance for Australian households and organisations. The endpoint is a stable system with no unauthorised persistence, no unexplained Defender exceptions and no evidence that the Trojan has returned.