Trojan:Win64/Lazy.PGLI!MTB: Meaning and Removal

Trojan:Win64/Lazy.PGLI!MTB quick verdict

What the Lazy.PGLI!MTB detection means

Microsoft Security Intelligence has an exact record for Trojan:Win64/Lazy.PGLI!MTB. Microsoft says Defender detects and removes the threat and recommends current security intelligence plus a full scan to find remnant files or system changes. The same record currently lists no aliases and says technical threat behavior is not available.¹

That limits what anyone can safely infer from the label. It is reasonable to treat the verdict as malicious until the evidence is reviewed. It is not reasonable to claim that every computer with this alert has the same stealer, startup file, or network destination. A forum fix for one person’s Recycle.exe, proxy, task, or script should not be copied to a different PC unless the same artifact is actually present.

For a broader explanation of family, platform, and suffix fields, use the Microsoft Defender detection-name guide. The exact affected-item details still control the cleanup decision.

Read the affected item: file, process, or old event

Open Windows Security → Virus & threat protection → Protection history, expand the newest matching card, and record:

• the exact detection name and time;
• the action status: quarantined, removed, blocked, action needed, or remediation incomplete;
• the complete affected item, including the path, container, process, or resource;
• what was downloaded, opened, installed, restored, or synced immediately beforehand.

Microsoft explains that Protection History records Defender actions and that a quarantined item is blocked from running, while remediation incomplete means Defender could not finish the cleanup. The page keeps events for about two weeks, so save the useful details before they expire.²

Can Lazy.PGLI!MTB be a false positive?

A false positive is possible with any security product, but a clean result from another scanner does not establish one. Products use different engines, telemetry, scan scopes, update times, and behavior signals. A process-only event may also leave no file for a later on-demand scanner to inspect.

Use the false-positive lane only when you have a specific accessible file and strong provenance:

• it came from the publisher’s official channel;
• its digital signature is valid and matches the expected publisher;
• the version and hash match a known release;
• the file was not delivered by a crack, repack, cheat, random archive, copied command, or unknown message;
• no unrelated persistence, account abuse, browser changes, or repeated detections appear.

Keep the item quarantined during review. If the evidence supports a clean file, submit that exact sample through the safe false-positive reporting workflow and wait for a determination before restoring or creating an exclusion. If the event contains only a process and no sample, do not invent a file from a forum case.

How to remove Trojan:Win64/Lazy.PGLI!MTB safely

1. Disconnect if compromise is active. If unknown purchases, messages, remote access, or fresh account sessions are appearing, disconnect the affected PC from the network and use a different clean device for urgent account actions.
2. Keep the Defender action in place. Quarantine or remove the item. Do not choose Allow just to stop the notification.
3. Save the evidence. Record the exact status, affected item, path or process entry, time, and the download or app that preceded it.
4. Remove the source. Delete the original download, archive, attachment, unofficial installer, browser cache item, or synced copy that can recreate the detected object. Do not delete an unrelated Windows file based on its name alone.
5. Update Windows and Defender security intelligence. Then run a full scan, not only a quick scan.
6. Use Microsoft Defender Offline when persistence is plausible. It restarts into the Windows Recovery Environment, where malware running inside normal Windows has a harder time hiding or defending itself.³
7. Run a focused second-opinion cleanup scan. Gridinsoft Anti-Malware can check for additional detections, hidden files, startup entries, scheduled tasks, services, bundled apps, browser changes, and other persistence around the visible event.
8. Reboot and compare evidence. A clean result means no new matching event, no recreated source, and no unexplained security or account activity—not merely that an old Protection History card still exists.

Defender may quarantine a visible item while a loader, scheduled task, service, browser change, exclusion, or bundled module remains if the original file ran. That is why repeated alerts, new timestamps, unknown %LOCALAPPDATA%\Temp files, and startup-triggered events justify a persistence scan rather than deleting one path and assuming the case is closed.

If Trojan:Win64/Lazy.PGLI!MTB keeps coming back

Compare each new event instead of treating every notification as identical:

• Same archive, installer, or Downloads path: the container or original download is still present. Remove it and any extracted copy.
• Same browser, Discord, or app cache: close the app, clear the affected cache, update the app, and check extensions or recently installed plug-ins. Do not assume the legitimate app executable itself is infected without path or signature evidence.
• Same OneDrive or other sync path: pause sync, remove the unsafe source from the synced folder and cloud recycle bin where applicable, scan the local files, then resume. The detection does not by itself prove that the cloud service or account is infected.
• New AppData, ProgramData, Startup, or task-created item: audit the parent process, Startup Apps, Task Scheduler, Services, recently installed apps, and browser extensions.
• Only the same old history time: confirm that scans remain clean and no new event appears. Do not delete Defender’s history or quarantine folders as a standard “removal” step.

Use the Windows security audit after malware when the source is unclear or security settings changed. It routes startup, task, service, browser, proxy, DNS, remote-access, and account checks in a safer order than case-specific registry deletion.

What to do if accounts or payments were abused

Confirmed unauthorized purchases, password changes, sent messages, new sessions, or recovery-detail changes are independent evidence of compromise even if a later scan is clean. From a separate trusted device:

1. call the bank or card issuer about unauthorized transactions and lock affected payment methods;
2. change the primary email password first, then banking, shopping, social, gaming, and work passwords;
3. sign out other sessions, revoke unknown devices or connected apps, and replace reused passwords;
4. enable multi-factor authentication and save new recovery codes;
5. check email forwarding rules, recovery addresses, account activity, browser sync, and stored payment details.

Do not change all passwords on the affected PC while unknown malware may still be running. Cleanup cannot reverse already stolen cookies or passwords, so session revocation and account recovery remain necessary after the device is cleaned.

When a clean Windows reinstall is justified

A single blocked file does not automatically require a reinstall. Consider one when:

• the same detection returns with new timestamps after full and offline scans;
• unknown tasks, services, administrator accounts, remote-access tools, or Defender exclusions recreate themselves;
• account or financial abuse shows that credential theft likely occurred;
• Windows Security, updates, or core services cannot be restored reliably;
• the PC handles sensitive business or financial data and its integrity cannot be established.

Create the installer from a clean device and back up documents, photos, and other necessary data—not cracks, scripts, unknown executables, browser profiles, or old installers. The clean Windows install USB guide covers the safe media and restore order.

What not to do

• Do not restore or allow the item only because a second scanner is clean.
• Do not search a later Task Manager PID and delete whichever process happens to use that number.
• Do not copy FRST scripts, registry deletions, proxy removals, or filenames from somebody else’s support thread.
• Do not clear Protection History or Defender quarantine folders as a substitute for removing the source.
• Do not create broad exclusions for Downloads, Temp, AppData, game folders, or an entire drive.
• Do not restore a full browser profile or software backup before the clean system has been scanned.

FAQ

References

1. Microsoft Security Intelligence. “Trojan:Win64/Lazy.PGLI!MTB threat description.” Microsoft, published and updated September 18, 2025, accessed July 15, 2026. Microsoft threat description.
2. Microsoft Support. “Protection History in the Windows Security App.” Microsoft, accessed July 15, 2026. Windows Security Protection History.
3. Microsoft Support. “Virus and Threat Protection in the Windows Security App.” Microsoft, accessed July 15, 2026. Microsoft Defender Offline scan guidance.