trying to remove 'trojan found in /Win32' pop up

“Google Defender” is not a Windows security product, so after noting the Microsoft Safety Scanner’s final result, block the suspicious website’s notification permission in your browser—the “Trojan found in /Win32” message is likely a fake browser alert.

1. Act on the completed scan result

• If the completion screen said no threats were found: close Safety Scanner and continue with the browser cleanup below.
• If threats were found and removed: close the scanner and continue with the browser cleanup so the fake warning does not return.
• If removal failed or an error appeared:
  1. Select Start and enter %systemroot%\debug.
  2. Open the file named msert.
  3. Scroll to the latest entry and note any code beginning with 0x.
  4. Follow the action associated with that code. For example, 0x80508024 requires a full scan, while 0x80508026 means the detected item is inside an archive such as a ZIP file and must be removed manually.^1^

Do not call a number, install software, pay money, or grant remote access through the pop-up.

2. Stop the browser notification

Use the section matching the browser where the alert appears. The words “Google Defender” do not establish which browser generated it.

Google Chrome

1. Open Chrome → More (⋮) → Settings.
2. Select Privacy and security → Site settings → Notifications.
3. Under sites allowed to send notifications, find any site you do not recognize.
4. Select its menu and choose Block or Remove.^2^
5. Run Settings → Privacy and security → Safety Check to identify other unsafe settings or permissions.^3^

If the alerts continue, reset Chrome using Settings → Reset settings → Restore settings to their original defaults.^4^

Microsoft Edge

1. Open Edge → Settings and more (…) → Settings.
2. Select Privacy, search, and services → Site permissions → All sites.
3. Select the suspicious site.
4. Find Notifications and choose Block.^5^
5. Under Site permissions → Pop-ups and redirects, turn on Blocked (recommended).^6^

3. Check for a genuine Windows Security alert separately

Safety Scanner’s completion screen and msert log relate to that scan. Windows Security → Protection history is a separate record of Microsoft Defender activity; it is not the authoritative record for the Safety Scanner scan.

In Protection history:

• Threat blocked: no further action is required.
• Threat quarantined: expand it and select Remove.
• Threat found – action needed: select Actions → Quarantine.
• Remediation incomplete: expand the entry and perform the additional action shown.

Do not select Allow on device unless the file is known to be safe.^7^

If the same genuine Defender detection repeatedly returns after the browser permissions are removed, save open work and run Windows Security → Virus & threat protection → Scan options → Microsoft Defender Antivirus (offline scan) → Scan now. The computer will restart for this scan.^8^

References

1. How to troubleshoot an error when you run the Microsoft Safety Scanner | Microsoft Support
2. Use notifications to get alerts - Computer - Google Chrome Help
3. Manage Chrome safety and security - Computer - Google Help
4. Remove unwanted ads, pop-ups & malware - Computer - Google Chrome Help
5. Manage website notifications in Microsoft Edge | Microsoft Support
6. Block pop-ups in Microsoft Edge | Microsoft Support
7. Protection History in the Windows Security App | Microsoft Support
8. Virus and Threat Protection in the Windows Security App | Microsoft Support