Free tools Windows power users keep installed
One-click scans. No signup required.
Trojan:PowerShell/Boxter.HGS!MTB is a genuine Microsoft Defender Antivirus detection label. Microsoft lists it as a trojan-class threat that Defender can detect and remove, but its public entry contains no aliases or technical description of the exact payload. The alert does not, by itself, prove that Windows PowerShell has been replaced or that a persistent infection remains.
What the detection name means
Microsoft’s threat encyclopedia identifies Trojan:PowerShell/Boxter.HGS!MTB as a Microsoft Defender detection. The entry was published and updated on December 24, 2025; no newer public technical analysis was identified through August 18, 2026.
As an Amazon Associate I earn from qualifying purchases.
- Trojan is Microsoft’s broad classification for the detected threat or behavior.
- PowerShell means the alert is associated with PowerShell or content delivered or inspected through it.
- Boxter.HGS!MTB is the detection identifier. It should not be treated as a documented malware-family name or decoded into capabilities Microsoft has not published.
The label can be triggered by a script, command line, downloaded payload, memory behavior, or activity inspected through PowerShell’s antimalware interface. It does not identify one guaranteed executable, infection path, or attacker.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIs it a real virus or a false alarm?
It is a real security detection published by Microsoft. “Virus” is colloquial; Microsoft calls this a threat and classifies it as a trojan. A detection still does not prove that a full, persistent infection is active. Defender may have blocked or quarantined the item, or another component may be recreating it after cleanup.
#1 Best Overall
- Reliable Plug and Play: The USB receiver provides a reliable wireless connection up to 33 ft (1), so you can forget about drop-outs and delays and you can take it wherever you use your computer
- Type in Comfort: The design of this keyboard creates a comfortable typing experience thanks to the low-profile, quiet keys and standard layout with full-size F-keys, number pad, and arrow keys
- Durable and Resilient: This full-size wireless keyboard features a spill-resistant design (2), durable keys and sturdy tilt legs with adjustable height
- Long Battery Life: MK270 combo features a 36-month keyboard and 12-month mouse battery life (3), along with on/off switches allowing you to go months without the hassle of changing batteries
- Easy to Use: This wireless keyboard and mouse combo features 8 multimedia hotkeys for instant access to the Internet, email, play/pause, and volume so you can easily check out your favorite sites
Microsoft says Defender detects and removes the threat, while warning that malware can leave remnant files or system changes. The official entry does not establish password theft, ransomware, cryptocurrency mining, a particular command-and-control server, or any other specific capability for this identifier.
Does the alert mean PowerShell itself is infected?
Usually, no conclusion about the PowerShell executable can be drawn from the name alone. Legitimate Windows PowerShell is normally installed under the Windows directory and can be used by both administrators and malicious scripts as a trusted interpreter. Defender can detect malicious script content through AMSI (Antimalware Scan Interface) while the signed Microsoft executable remains unchanged.
Some user reports show events referencing an amsi:DeviceHarddiskVolume...WindowsSystem32WindowsPowerShellv1.0powershell.exe path. That path alone is not proof that the file was replaced. Conversely, malware can masquerade as powershell.exe elsewhere.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →- Do not delete or replace
powershell.exemanually. - Check whether the file is in the normal Windows PowerShell directory and whether its Microsoft digital signature is valid.
- For a recurring event, the important evidence is the parent process, command line, script path, creation time, and trigger—not merely the word “PowerShell.”
What to do immediately
- Do not choose Allow on device.
- If Windows Security says the threat is active or running, temporarily disconnect the computer from the internet, particularly when it contains financial, business, health, or personal data.
- Save work, close unnecessary applications, and do not open suspicious scripts, cracks, keygens, email attachments, or downloaded archives.
- Open Windows Security → Virus & threat protection → Protection history. Record the time, status, affected item, path, and available action before clearing or changing anything.
- Install pending Windows updates and Defender security-intelligence updates.
- Run a full scan, then use Microsoft Defender Offline if the alert returns.
Microsoft documents these controls for Windows 10 and Windows 11 in its Windows Security scan and Protection history guidance. Labels can vary by Windows build and language.
Supported removal and verification process
1. Interpret Protection history
- Removed or quarantined: Defender blocked the item; continue scanning if a new event appears.
- Active: Treat the system as potentially compromised and proceed to a full scan followed by an offline scan.
- Allowed: Open the event and choose Don’t allow or remove the allowance. Allowed threats are not acted on until disallowed.
- Repeated PowerShell event: Look for the originating script, task, startup item, or downloaded payload rather than assuming the executable is malicious.
2. Update protection
Allow Windows Update and Defender security-intelligence updates to finish. A stale engine may miss a remnant, while a newer engine may report one that an earlier scan did not.
Rank #2
- KEYBOARD: The keyboard works for Windows with hot keys that enable easy access to Media, My Computer, Mute, Volume up/down, and Calculator
- EASY SETUP: Experience simple installation with the USB wired connection
- VERSATILE COMPATIBILITY: This keyboard is designed to work with multiple Windows versions, including Vista, 7, 8, 10 offering broad compatibility across devices.
- SLEEK DESIGN: The elegant black color of the wired keyboard complements your tech and decor, adding a stylish and cohesive look to any setup without sacrificing function.
- FULL-SIZED CONVENIENCE: The standard QWERTY layout of this keyboard set offers a familiar typing experience, ideal for both professional tasks and personal use.
3. Run a full scan
- Open Windows Security → Virus & threat protection → Scan options.
- Select Full scan → Scan now.
- Restart when finished and review Protection history again.
A full scan checks every file and program and can take a long time on large disks. “No current threats” means that scan reported none; it is not proof that the machine has never been compromised.
4. Run Microsoft Defender Offline
Use Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now when the alert returns after reboot, remediation is incomplete, or a process appears to recreate the detection. Save work first. Windows restarts into the Recovery Environment and scans before normal Windows processes load; results appear in Protection history afterward. Microsoft explains this mode in its Defender Offline technical overview.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errors5. Try the Malicious Software Removal Tool when remediation is partial
Microsoft’s antivirus FAQ suggests this additional check:
- Press Windows key + R.
- Enter
%windir%system32mrt.exeand approve the prompt. - Complete the scan and cleanup wizard, restart, and install pending updates.
Microsoft’s FAQ presents MRT as supplemental cleanup, not a replacement for current Defender protection or Offline scan.
6. Scan a specific file without running it
If Protection history identifies a file, leave it unopened. In File Explorer, right-click the file or folder; on Windows 11 select Show more options if needed, then choose Scan with Microsoft Defender. Do not upload confidential material to public scanners. See Microsoft’s per-file scanning instructions.
Rank #3
- 【Ergonomic Design, Enhanced Typing Experience】Improve your typing experience with our computer keyboard featuring an ergonomic 7-degree input angle and a scientifically designed stepped key layout. The integrated wrist rests maintain a natural hand position, reducing hand fatigue. Constructed with durable ABS plastic keycaps and a robust metal base, this keyboard offers superior tactile feedback and long-lasting durability.
- 【15-Zone Rainbow Backlit Keyboard】Customize your PC gaming keyboard with 7 illumination modes and 4 brightness levels. Even in low light, easily identify keys for enhanced typing accuracy and efficiency. Choose from 15 RGB color modes to set the perfect ambiance for your typing adventure. After 30 minutes of inactivity, the keyboard will turn off the backlight and enter sleep mode. Press any key or "Fn+PgDn" to wake up the buttons and backlight.
- 【Whisper Quiet Design】Experience near-silent operation with our whisper-quiet gaming switch, ideal for office environments and gaming setups. The classic volcano switch structure ensures durability and an impressive lifespan of 50 million keystrokes.
- 【IP32 Spill Resistance】Our quiet gaming keyboard is IP32 spill-resistant, featuring 4 drainage holes in the wrist rest to prevent accidents and keep your game uninterrupted. Cleaning is made easy with the removable key cover.
- 【25 Anti-Ghost Keys & 12 Multimedia Keys】Enjoy swift and precise responses during games with the RGB gaming keyboard's anti-ghost keys, allowing 25 keys to function simultaneously. Control play, pause, and skip functions directly with the 12 multimedia keys for a seamless gaming experience. (Please note: Multimedia keys are not compatible with Mac)
Optional diagnostic commands
In an elevated Windows Terminal, these Microsoft Defender cmdlets can show detections or start a full scan:
Get-MpThreat
Get-MpThreatDetection
Start-MpScan -ScanType FullScanThey may be unavailable, restricted by organizational policy, or require administrator rights. They do not identify the original downloader or persistence mechanism. Do not disable Defender, bypass execution policy, or run arbitrary “fix” scripts from file-sharing links. Commands such as Remove-MpThreat are not a universal cure.
If the alert keeps coming back
Separate history from a new infection
Protection History can contain old or duplicate blocked events. Compare timestamps and status. A new active event after reboot is more concerning than an old quarantined entry; an event that appears only when one document, application, or website opens points toward that trigger.
Consider persistence, but investigate from evidence
Microsoft notes that recurring malware can result from an undetected component that reinstalls it, often after restart, and recommends Defender Offline. Potential locations include Task Scheduler, Startup folders, Run/RunOnce keys, services, browser extensions, login scripts, AppData, and Office or scripting launch points.
Do not delete a task, registry value, service, or random-named AppData folder merely because it looks unfamiliar. Legitimate software also uses generated names. Use the Defender event, trusted diagnostic logs, or a qualified analyst to establish that an item is malicious before removing it.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #4
- Take your gaming skills to the next level: The Logitech G413 SE is a full-size keyboard with gaming-first features and the durability and performance necessary to compete
- PBT keycaps: Heat- and wear-resistant, this computer gaming keyboard features the most durable material used in keycap design
- Tactile mechanical switches: Uncompromising performance is always within reach with this wired gaming keyboard
- Premium color, material and finish: Elevate your gaming setup with this backlit keyboard featuring a sleek, black-brushed aluminum top case and white LED lighting
- 6-Key rollover anti-ghosting performance: Experience reliable key input with this anti-ghosting keyboard versus non-gaming mechanical keyboards
When an event mentions AMSI and powershell.exe
Verify the executable’s directory and signature, then determine which parent process launched it and what command line or script was supplied. Those details generally require Defender logs, Event Viewer, Microsoft Defender for Endpoint, or specialist analysis; the detection name cannot supply them.
Second-opinion scanners
A second scan is optional after Defender remediation, not a substitute for Defender Offline. Malwarebytes offers an on-demand scanner; a clean result does not disprove a Defender event involving blocked script activity. Microsoft Safety Scanner is another on-demand option. Neither proves that credentials were not exposed or that every persistence mechanism is absent.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When to disconnect, change passwords, or reset Windows
Seek reputable professional or organizational incident-response help if the alert remains active after Offline scan, security tools cannot update, new administrator accounts or extensions appear, files are altered or encrypted, multiple unrelated detections occur, or you cannot identify the affected item. On a work computer, preserve logs and contact IT before wiping it.
If compromise is plausible, change email and financial-account passwords from a known-clean device and enable multifactor authentication. A reset or reinstall may be necessary when malware has caused irreversible changes. Preserve important data and restore only from backups made before the suspected infection, following Microsoft’s recurring-malware guidance.
Recommended Free Tools
What not to do
- Do not delete
powershell.exe. - Do not run anonymous Fixlist files or registry-cleanup instructions.
- Do not disable real-time protection or add exclusions for suspicious files.
- Do not assume a clean Malwarebytes scan disproves Defender.
- Do not erase Protection History as a first-line “fix”; it removes evidence, not malware.
- Do not reset Windows before recording the detection path unless immediate containment is more important.
Microsoft warns that turning off real-time protection leaves newly opened or downloaded files unscanned and recommends exclusions only for files or folders you genuinely trust.
Best Value
- 【65% Compact Design】GEODMAER Wired gaming keyboard compact mini design, save space on the desktop, novel black & silver gray keycap color matching, separate arrow keys, No numpad, both gaming and office, easy to carry size can be easily put into the backpack
- 【Wired Connection】Gaming Keybaord connects via a detachable Type-C cable to provide a stable, constant connection and ultra-low input latency, and the keyboard's 26 keys no-conflict, with FN+Win lockable win keys to prevent accidental touches
- 【Strong Working Life】Wired gaming keyboard has more than 10,000,000+ keystrokes lifespan, each key over UV to prevent fading, has 11 media buttons, 65% small size but fully functional, free up desktop space and increase efficiency
- 【LED Backlit Keyboard】GEODMAER Wired Gaming Keyboard using the new two-color injection molding key caps, characters transparent luminous, in the dark can also clearly see each key, through the light key can be OF/OFF Backlit, FN + light key can switch backlit mode, always bright / breathing mode, FN + ↑ / ↓ adjust the brightness increase / decrease, FN + ← / → adjust the breathing frequency slow / fast
- 【Ergonomics & Mechanical Feel Keyboard】The ergonomically designed keycap height maintains the comfort for long time use, protects the wrist, and the mechanical feeling brought by the imitation mechanical technology when using it, an excellent mechanical feeling that can be enjoyed without the high price, and also a quiet membrane gaming keyboard
Frequently Asked Questions
Can I delete PowerShell to stop the alert?
No. PowerShell is a Windows component. Investigate the script, command line, path, signature, and launching process instead of deleting the executable.
Does a quarantined event mean the computer is safe?
It means Defender contained that detected item. Review Protection history, update Defender, run a full scan, and use Offline scan if a new event returns.
Should I buy another antivirus?
No purchase is required for the supported removal path. An on-demand second opinion can be useful, but it does not replace Defender Offline or prove that credentials were never exposed.
The Bottom Line
Treat Trojan:PowerShell/Boxter.HGS!MTB as a genuine Defender warning, not proof that PowerShell itself is corrupted. Preserve the event details, update Defender, run a full scan, and escalate to Defender Offline and professional help when detections recur or compromise is plausible.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
