How to remove the trojan MSIL/BadJoke!MTB

Run a full scan with the Windows Malicious Software Removal Tool (MSRT), restart Windows, install all updates, and then use Microsoft Defender Offline if MSIL/BadJoke!MTB remains detected.

Microsoft identifies Trojan:MSIL/BadJoke.SL!MTB as malware capable of performing actions chosen by an attacker; incomplete remediation can leave files or system changes behind.^1^

1. Run the prescribed scan for partial removal

1. Disconnect the computer from the internet temporarily.
2. Press Windows key + R.
3. Enter:

      %windir%\system32\mrt.exe
   

4. Select Yes at the permission prompt.
5. Choose Full scan, complete the scan, and remove anything detected.
6. Restart the computer.
7. Reconnect and open Settings → Windows Update → Check for updates. Install all available updates and restart again.

Microsoft specifically prescribes this MSRT full-scan sequence when a threat is reported as partially removed.^2^

2. If it remains, run Microsoft Defender Offline

Save your work first—the computer will restart immediately.

1. Open Windows Security.
2. Select Virus & threat protection → Scan options.
3. Select Microsoft Defender Offline scan → Scan now.
4. Approve the prompt and allow the scan and restart to finish.
5. Return to Windows Security → Virus & threat protection → Protection history and check whether the threat was removed.

The offline scan runs outside normal Windows, helping detect persistent malware that hides while Windows is running.^3^

Alternatively, open PowerShell as administrator, save all work, and run:

Start-MpWDOScan

This command immediately restarts the computer for the offline scan.^4^

BitLocker prerequisite: If BitLocker protects the system drive, suspend its protection first or have the recovery key available. Defender Offline also requires administrator access and Windows Recovery Environment (WinRE) to be enabled.^4^

3. Verify the result

In Protection history, expand the latest entry and note:

• Whether its status is Removed, Quarantined, or still Remediation incomplete.
• The affected file’s full path.
• Whether the same path is detected after another restart.

Do not choose Allow or Restore. Quarantine blocks a detected file from running, while restoring returns it to its original location.^2^

If the path points into a downloaded archive, installer, email attachment, or removable drive, delete that original source and empty the Recycle Bin before rescanning. Also avoid revisiting the download site or reopening the message that supplied it; reinfection can otherwise reproduce the detection.^3^

4. If detection continues

• Ensure the Windows system drive has sufficient free space; Defender can fail to quarantine or remove threats when space is insufficient.^5^
• Run the on-demand Microsoft Safety Scanner, which Microsoft lists alongside Defender for detecting and removing trojans.^6^
• If the same threat survives MSRT and Defender Offline, back up personal documents only—not programs, installers, scripts, or archives—and reset or clean-install Windows. Prefer a backup created before the infection because backups present during an infection may have been modified.^5^

After cleanup, change important passwords from a known-clean device and enable multifactor authentication, particularly for email, financial, and Microsoft accounts. Trojans can record sign-in information or provide remote control of a device.^6^

Do not use a fixlist.txt or Farbar script written for another computer; such scripts are machine-specific and can damage a different Windows installation.^7^

References

1. Trojan:MSIL/BadJoke.SL!MTB threat description - Microsoft Security ...
2. Antivirus and antimalware software: FAQ | Microsoft Support
3. Troubleshoot problems with detecting and removing malware | Microsoft Support
4. Run and review the results of a Microsoft Defender Offline scan
5. Troubleshoot problems with detecting and removing malware
6. Trojan malware - Microsoft Defender for Endpoint
7. My Windows Security shows a list of Threats that I can't remove, or fix. - Microsoft Q&A