stubborn Trojan:Win32/Kovter.G

[Guest AndreXie]

Everytime I restart my Win 10 Pro PC, Windows Security will report a threat (Trojan:Win32/Kovter.G) has been blocked and removed --

 

Affected items:

 

CmdLine: C:\Windows\System32\cmd.exe /c MsHta VBScript:Execute(CreateObject("Scripting.Filesystemobject).GetStandardStream(1).Write(Msgbox(Set the environment successfully,the computer need to restart for initiate the software,do you want to restart now? ,64+4,Information)))(Close)

 

 

I tried to remove it using tools from Microsoft, Symantec and Kaspersky, all tools can't find anything, even in Safe Mode. Then when I restart my PC, Windows Security will report the same issue again.

 

 

The weird part is if I shut down my PC then cold start it, Windows Security will not report this threat, only when I restart PC, WIndows Security will be triggered again. Really annoying.

 

 

My Windows 10 system has been updated to the latest.

 

 

What should I do? Please help. Thanks.

 

More...