Trojan:Win32/Malgent!MSR: Removal & False Positive Checks

Trojan:Win32/Malgent is a Microsoft Defender detection name for suspected Trojan malware, often shown as Trojan:Win32/Malgent!MSR. Treat it as a warning about the flagged file, not a complete diagnosis of your PC. Keep the file quarantined and check its affected path, action status and whether you ran it. A download blocked before you opened it needs a different response from a program you ran or an alert marked Remediation incomplete. The detection name alone cannot tell you whether passwords were stolen or whether the file is a false positive.

What is Trojan:Win32/Malgent!MSR?

Malgent is a detection name, not enough information to reconstruct an infection. Microsoft describes attacks involving tampered software, remote access, credential theft and additional downloads. Its MSR entry describes DLL sideloading: an attacker supplies a software package in which a legitimate application loads a malicious DLL from the same folder. A valid signature on the launcher does not authenticate that adjacent DLL. This is why repeatedly launching the same extracted package can be risky even after one file was removed. The scenario does not establish what happened on every PC displaying the label. [1]

The useful questions are: Which file was detected, where did it come from, did it execute, and did remediation finish? A signed application beside a malicious DLL, a cached web object and an unexpected driver are different investigations.

What do !MSR, !MTB, !MBT and !AMTB mean?

Microsoft describes a suffix beginning with ! as an internal indicator. Do not read !MSR, !MTB, !MBT or !AMTB as a public severity scale or a guarantee of a false positive. Record the complete name exactly as it appears. Our Microsoft Defender detection-name guide explains the type, platform, family and suffix.

HackTool:Win64/Malgent!MSR is a different full label. If that is your warning, keep its exact wording and use the HackTool and truesight.sys checks below rather than assuming every Malgent result describes the same file.

How to remove Malgent from Windows

1. Read the current status in Protection history

Open Windows Security → Virus & threat protection → Protection history. Expand the Malgent event; Windows may require administrator approval to show its details. Record the full detection name, date, affected items and action result before clearing temporary files. [2]

• Threat found — action needed: Choose Quarantine for an unverified file. Do not choose Allow on device to make the warning disappear.
• Threat quarantined: The item is isolated. Leave it there or choose Remove if you do not need it; Restore puts it back.
• Threat blocked: Defender reports that it blocked and removed the threat. Check how it arrived and whether you ran anything else from that package.
• Remediation incomplete: Cleaning did not finish. Read the event details and continue with scanning and the repeated-alert checks below.

Keep the event’s time in mind. Seeing the same old card again is different from receiving a new detection after a restart. If you accidentally chose Allow on device, open Virus & threat protection → Allowed threats, remove that item from the allowed list, then update and scan again. Do not add an exclusion to silence the warning.

Read “Affected items”: a cache object is not an installed program

The historical card below, posted to r/antivirus in December 2024, shows Trojan:Win32/Malgent in Chrome’s Cache_Data folder. Its Portuguese status says the threat was blocked and removed. The useful detail is the two related paths, not the severity badge. [4]

• containerfile: the stored cache object, ending in Cache_Data\f_004306.
• file: the same object followed by ->(GZip), identifying content inside that compressed container. Two lines here do not establish two separate installed Trojans.

This card records a detection and removal; it does not show that a desktop executable ran or prove a false positive. For a current cache detection, note the exact path and event time, close the implicated page, clear cached files through that browser’s settings, update protection and scan. Do not deliberately revisit a suspect page to reproduce the alert. If a new event instead names a downloaded executable, an extracted DLL or a driver, investigate that object rather than treating every Malgent warning as the old cache case.

2. Match the response to whether the file ran

If it was only downloaded and blocked: do not open or extract it to investigate. Remove an unwanted original archive as well as any extracted copies that your scanner identifies. Update your protection and scan the PC. With no execution, fresh detections or account symptoms, a blocked download alone does not justify reinstalling Windows.

If you ran an unknown installer, executable, script or game tool: disconnect Wi-Fi/Ethernet and avoid entering passwords on that PC. Quarantining one file cannot undo actions it took earlier. If the affected device belongs to work or school, give IT the detection details before doing manual cleanup.

A game title, repack name or familiar download site does not authenticate the files inside an archive. If the instructions tell you to disable Defender or exclude an installation folder, stop. The HackTool:Win32/Crack guide explains why a functioning crack and a safe download are different questions.

3. Run a full scan and apply cleanup

For the cleanup scan, use Gridinsoft Anti-Malware from its official website. A quarantined file may be only one part of a package that ran; the scan checks for related threats and persistence. Keep the original detection blocked while you complete these steps.

1. Download and install the official application. If you isolated the PC after suspicious code ran, obtain the installer and recovery instructions on a trusted device. Do not resume ordinary browsing or sign in to sensitive accounts on the suspect PC to collect tools.
2. Update before scanning. Open Update → Check now and confirm the Threat List is current. If isolation prevents updating, seek IT or recovery assistance rather than downloading unofficial database files or weakening protection.
3. Choose Scan → Full. Let the scan finish, then review each detection’s name, object path and proposed action. Apply quarantine or removal to identified threats; investigate a disputed legitimate file before restoring or excluding it.
4. Restart Windows and verify the result. Review the cleanup report and compare any new Malgent event’s timestamp and path with your original notes. If a fresh alert appears, use the recurrence checks below. A clean scan does not establish what happened before cleanup.

If the installer or scanner cannot run, or cleaning fails, use trusted recovery assistance or Windows Security → Virus & threat protection → Scan options → Microsoft Defender Offline scan. Save your work and have your BitLocker recovery key available before recovery troubleshooting. Offline scanning restarts the PC and checks it outside the normal Windows session. Afterwards, review Protection history for the action result and return to the updated Gridinsoft scan when normal access is restored. If Offline scan will not start, follow our Defender Offline troubleshooting guide. Keep Defender security intelligence current through Protection updates → Check for updates.

If a new Malgent alert returns after quarantine, a remaining file, task or service may be recreating the detected object. A full scan checks for related threats; it does not recover accounts or guarantee that no earlier exposure occurred.

Why does Malgent keep coming back after removal?

Compare the new event’s timestamp and affected path with your notes. This avoids confusing a retained history entry with a file that has actually returned.

• Same old event; no new detection: Check its final action status. Do not delete Defender’s history folders just to hide the card.
• Fresh event after downloading or extracting the same archive: The source package or another extracted copy may still be present. Stop re-downloading it and scan the package’s location.
• Fresh browser-cache object after visiting a page: Close that page, clear the affected browser’s cached files through its settings and scan. Investigate extensions if the behavior continues.
• File reappears after restart without another download: Check the matching startup entry, scheduled task, service or driver. A remaining component may be recreating it.

If a new event remains after the full scan and restart, save its exact path and action result for support. Do not copy another person’s registry cleanup or FRST fix script: a fix written for a different machine can remove settings or files you need.

Persistence points worth checking

These manual checks are optional, targeted follow-up when a fresh detection or symptom remains after scanning and restart. Use the detected path to guide them. AppData, Temp and Windows driver folders also contain legitimate software; their location alone is not a reason to delete them.

• Startup: review Startup Apps and the folders opened with shell:startup and shell:common startup. Look for a target connected to the flagged package.
• Scheduled tasks: inspect the task’s Actions tab. Record the executable path, arguments and trigger before changing a task.
• Services and drivers: identify the owning application, publisher and file version. A recurring driver alert needs the additional checks below.
• Run entries: an advanced review can include HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Do not remove entries just because their names are unfamiliar.
• Companion DLLs: inspect the full package identified by the scanner. Removing one DLL while repeatedly launching its installer can recreate the problem.

Can Malgent be a false positive?

Yes, an antivirus can misclassify a legitimate file. But a familiar filename, an old forum reply or a clean result from another scanner does not resolve your exact detection. Keep the file blocked while you collect evidence:

1. Identify the actual file. Save the full label, affected path, file or application version, download source, detection time and action result. For an archive, record which item inside it was flagged. If the file is already quarantined, do not restore it just to inspect it.
2. Check the source and publisher. Compare a legitimately obtained copy with the developer’s release information. Tor Browser, FRST64.exe and other known tools still need an authentic source and matching version. A signature is one clue; some legitimate tools are unsigned, and signed files can still be vulnerable or misused.
3. Match the exact file, not only its name. If a SHA-256 hash is already available in a report, compare it with the developer’s published hash or give it to support. If a non-quarantined copy is already accessible, you can hash it without running it; our EXE file-verification guide explains the checks. Do not restore a blocked file merely to obtain a hash. Different versions of the same named file can have different results.
4. Update, then request a current verdict. Update Defender’s security intelligence and scan the legitimate package if it is safely available. If it remains flagged and you need it, ask its developer to investigate or submit it to Microsoft for review. A fresh authentic replacement is preferable to allowing an uncertain copy.

Use Microsoft’s file submission service for a disputed detection. Include the exact label, version and source; do not upload confidential or work files without the owner’s permission. If obtaining a sample would require restoring quarantine, ask the developer or your IT team to handle the submission. A review of one version does not automatically clear a different download.

Browser cache after Twitch or another website: use the cache-path checks above; the location alone neither proves an installed Trojan nor makes the object harmless. Game crack, online-fix DLL, repack or unknown installer: a game working normally, other users allowing it, or a low detection count does not authenticate the package. Do not disable protection or exclude the whole game folder as a test.

HackTool:Win64/Malgent!MSR and truesight.sys

If HackTool:Win64/Malgent!MSR names C:\Windows\System32\drivers\truesight.sys, investigate the driver separately. TrueSight has legitimate security-tool origins, but that does not make every copy safe. Check Point documented abuse of the legacy 2.0.2 driver to terminate security software; the campaign included thousands of modified copies that retained valid signatures. [3]

A valid signature is therefore insufficient for this decision. Check the file’s Properties → Details and Digital Signatures where available, then establish:

• Which installed application owns the driver, and did you intentionally install it?
• Does its version match the vendor’s supported release, or is an old copy being loaded?
• Does the related service point to that expected file?
• Did the alert begin after an unknown installer, or alongside security tools stopping unexpectedly?

An expected application with an outdated driver needs a vendor update or supported removal. An unexplained driver that returns after quarantine needs incident cleanup. Do not restore it to force a tool to work, and do not manually delete unrelated files from System32\drivers. If security tools cannot run reliably, use offline recovery or get help from IT rather than experimenting with loaded drivers.

The WinRing0x64.sys guide covers the related distinction between legitimate driver use and vulnerable-driver risk. A clean result from a second scanner can be useful evidence, but the driver version and installation history still matter.

How to check cleanup and protect your accounts

After remediation and a normal restart, confirm that there are no new Malgent events, no unresolved cleaning failures and no unexplained file or service returning. Review the scan report rather than relying only on a green status icon.

If the suspicious code ran, or you noticed unauthorized logins, use a separate trusted device to change affected passwords, starting with your primary email. Sign out other sessions, review recovery details and enable multi-factor authentication. Cleanup of the PC and recovery of an account are separate jobs: removing a file does not revoke a session an attacker already obtained.

Consider a clean Windows installation from official media if unwanted components persist, security settings keep changing or you cannot restore confidence after suspicious code executed. Back up personal documents carefully; do not carry the suspect installer, scripts or executable archives into the fresh installation.

FAQ

References

1. Microsoft Security Intelligence. “Trojan:Win32/Malgent!MSR threat description.” Updated February 4, 2026; accessed November 5, 2026. Threat description.
2. Microsoft Support. “Protection History in the Windows Security App.” Accessed November 5, 2026. Status definitions and actions.
3. Check Point Research. “Silent Killers: Unmasking a Large-Scale Legacy Driver Exploitation Campaign.” February 24, 2025; accessed November 5, 2026. Legacy TrueSight driver research.
4. r/antivirus contributor. “Trojan win32 Malgent.” December 12, 2024; accessed November 5, 2026. Original cache-warning screenshot and discussion. User report; not a verdict on other files.