How to Remove Trojan:Win32/ClicFix.PJ!MTB from Your Windows PC (Full Fix)

Microsoft Defender flagged Trojan:Win32/ClicFix.PJ!MTB on your PC and you are not sure what to do next. Quarantine alone is not enough. This trojan belongs to the ClickFix malware family, which often leaves behind hidden remnants, secondary payloads, and browser components even after the initial alert disappears.

This guide covers every step you need to fully remove Trojan:Win32/ClicFix.PJ!MTB, confirm your system is clean, and lock down your PC so it does not happen again.

What Is Trojan:Win32/ClicFix.PJ!MTB?

Trojan:Win32/ClicFix.PJ!MTB is a Windows trojan tied to the ClickFix social engineering technique. Attackers use fake browser error pages, CAPTCHA prompts, or document verification screens to trick you into copying and running a malicious command on your own machine.

Once you run that command, the trojan installs itself silently. It can then:

• Download and execute additional malware (info-stealers, remote access tools, ransomware loaders)
• Steal saved passwords, session tokens, and browser data
• Establish persistence so it survives a reboot
• Open a backdoor for the attacker to control your system remotely

Microsoft Threat Intelligence has documented ClickFix campaigns delivering payloads including Lumma Stealer, Latrodectus, MintsLoader, and OBSCURE#BAT. The PJ!MTB variant specifically indicates Defender caught it at the execution or persistence stage.

How Did Trojan:Win32/ClicFix.PJ!MTB Get on Your PC?

ClickFix attacks arrive through several channels:

• Fake browser update pages telling you to press Win+R and paste a command
• Malvertising where a sponsored search result leads to a fake fix page
• Phishing emails with documents that show a fake rendering error and instruct you to run a script
• Compromised websites injecting fake CAPTCHA overlays that copy a PowerShell command to your clipboard

If you recently visited an unfamiliar site and followed any kind of “fix” or “verification” instruction, that is almost certainly how Trojan:Win32/ClicFix.PJ!MTB entered your system.

How to Tell If Trojan:Win32/ClicFix.PJ!MTB Is Still on Your PC

You may see one or more of these after infection:

• A Microsoft Defender alert naming Trojan:Win32/ClicFix.PJ!MTB
• Slow PC performance or unusually high CPU or memory usage
• Random browser redirects or unexpected pop-ups
• New browser extensions you did not install
• Unfamiliar apps appearing in your installed programs list
• Defender showing the same threat repeatedly after removal (sign of active persistence)

Slow performance with no clear cause can also appear after other infections. If you are dealing with high CPU from a background process, check whether MSEdgeWebView2.exe is spiking CPU on your Windows PC as a separate issue, since ClickFix payloads sometimes abuse WebView2 components.

How to Remove Trojan:Win32/ClicFix.PJ!MTB from Windows

These steps fully remove Trojan:Win32/ClicFix.PJ!MTB, clear any leftover remnants, and cut off any persistence the trojan may have established.

Step 1: Let Defender Quarantine and Remove the Threat

If Defender has already flagged Trojan:Win32/ClicFix.PJ!MTB, it likely quarantined it automatically. Confirm this:

1. Open Windows Security from the Start menu
2. Go to Virus and threat protection
3. Click Protection history
4. Find the Trojan:Win32/ClicFix.PJ!MTB entry and confirm its status shows Quarantined or Removed

If it shows Allowed or Active, click the entry and select Remove or Quarantine immediately.

After confirming quarantine, run a fresh full scan. A Microsoft Defender virus scan checks every file on your drive and catches anything the initial quick scan may have missed.

To run a full scan:

1. Open Windows Security
2. Click Virus and threat protection
3. Under Current threats, click Scan options
4. Select Full scan
5. Click Scan now

This scan can take 30 to 60 minutes depending on your drive size. Do not interrupt it.

Step 2: Run Microsoft Safety Scanner as a Second Opinion

Microsoft Safety Scanner is a separate on-demand tool that uses the same engine as Defender but runs completely independently. It catches threats that resident protection may miss due to timing or active evasion.

1. Visit microsoft from a clean device if possible
2. Download the 32-bit or 64-bit version matching your Windows installation
3. Run msert.exe as Administrator
4. Select Full Scan and let it complete
5. Review the log at %SYSTEMROOT%\debug\msert.log for any additional threats found

Safety Scanner definitions expire after 10 days, so always download a fresh copy rather than reusing an old one.

Step 3: Remove Suspicious Browser Extensions

ClickFix campaigns frequently install malicious browser extensions as part of the payload. These extensions can steal session cookies, redirect searches, and inject ads even after the main trojan is removed.

Google Chrome:

1. Open Chrome and go to chrome://extensions/
2. Look for extensions you do not recognize or did not install
3. Click Remove on any suspicious entry
4. Restart Chrome

Microsoft Edge:

1. Open Edge and go to edge://extensions/
2. Review each extension carefully
3. Remove anything unfamiliar
4. Restart Edge

Firefox:

1. Open Firefox and go to about:addons
2. Click Extensions in the left panel
3. Remove unknown entries

Also reset your browser homepage and default search engine if either changed without your action.

Step 4: Uninstall Recently Installed Suspicious Apps

Some ClickFix payloads install a fake app or “updater” tool to maintain persistence. Check for anything installed around the time you saw the Defender alert.

1. Open Settings and go to Apps
2. Click Installed apps
3. Sort by Install date
4. Look for anything installed on or just before the date of the Defender alert
5. Uninstall anything you do not recognize

Pay close attention to apps with generic names like “System Optimizer,” “PC Cleaner,” or vague updater names. If an unfamiliar process name is running in Task Manager, check our guide on whether Updater.exe is a virus and whether you should remove it for a practical checklist to evaluate suspicious executables.

Step 5: Change Your Passwords from a Clean Device

If Trojan:Win32/ClicFix.PJ!MTB was active on your PC for any length of time, treat your saved passwords as potentially compromised. Info-stealer payloads can exfiltrate browser-saved credentials within seconds of running.

Change passwords for these accounts from a different device (phone or another PC you trust):

• Microsoft account
• Email accounts (Gmail, Outlook, etc.)
• Banking and financial services
• Any accounts where you were logged in through the browser

Enable two-factor authentication on all critical accounts if you have not already done so. This limits the damage even if an attacker already captured a password.

Step 6: Check for Persistence Mechanisms

Sophisticated ClickFix payloads add registry keys, scheduled tasks, or startup entries to survive a reboot. Check each location manually.

Scheduled Tasks:

1. Press Win + R, type taskschd.msc, and press Enter
2. In Task Scheduler Library, review tasks you do not recognize
3. Right-click and Delete any suspicious task
4. Pay attention to tasks with random-looking names or tasks that run PowerShell or cmd commands

Startup Programs:

1. Press Ctrl + Shift + Esc to open Task Manager
2. Click the Startup apps tab
3. Disable anything unfamiliar

Registry Run Keys:

1. Press Win + R, type regedit, and press Enter
2. Navigate to:
   • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
   • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
3. Look for entries pointing to unfamiliar file paths
4. Delete any entry you cannot verify as legitimate

Be careful in the registry. Only delete entries you can clearly identify as suspicious.

Step 7: Update Windows and All Software

Outdated software gives attackers an easy entry point. After cleaning the infection, apply all pending updates immediately.

1. Open Settings and go to Windows Update
2. Click Check for updates and install everything available
3. Restart your PC after updates complete
4. Update all browsers to their latest versions
5. Update any software you use regularly, especially PDF readers, media players, and office tools

Windows 11 includes built-in antivirus protection that improves with every update cycle. Keeping Windows current ensures Defender gets the latest threat definitions and engine improvements automatically.

How to Confirm Your PC Is Clean

After completing all steps above, run one final check:

1. Restart your PC
2. Run another Full Scan in Windows Security
3. Check Protection history and confirm no new threats appear
4. Monitor your PC for 24 to 48 hours for any returning symptoms

If Defender keeps detecting Trojan:Win32/ClicFix.PJ!MTB after multiple removals, the persistence mechanism is still active. In that case, boot into Windows Defender Offline Scan, which runs before Windows loads and catches rootkit-level threats that evade normal scanning.

To start an Offline Scan:

1. Open Windows Security
2. Go to Virus and threat protection
3. Click Scan options
4. Select Microsoft Defender Antivirus (offline scan)
5. Click Scan now and allow your PC to restart

How to Avoid ClickFix Attacks in the Future

Trojan:Win32/ClicFix.PJ!MTB reaches your PC only if you manually run a command or script. No exploit, no drive-by download. The attack relies entirely on tricking you. Knowing the signs stops it cold.

Red flags to watch for:

• Any website that tells you to press Win+R and paste something
• Any page showing a fake “verification failed” or “browser update required” message with copy-paste instructions
• Any pop-up claiming your PC is infected and asking you to call a number (see how the Microsoft Defender error code call is a scam for the exact tactics attackers use)
• Search result ads leading to software download pages you did not expect

Habits that protect you:

• Never paste or run anything from a website, even if the page looks official
• Always download software directly from the developer’s official site
• Keep SmartScreen enabled in Windows Security settings
• Use a standard user account for daily browsing and reserve the admin account for installs

Frequently Asked Questions

Related Tech Guides

• How to Run a Microsoft Defender Virus Scan (Beginner-Friendly)
• Windows 11 Built-In Antivirus in 2026: Do You Still Need Third-Party Protection?
• Is the Microsoft Defender Error Code Call a Scam?