Trojan.Gen.MBT: what the Symantec and Norton alert means and how to clear it
Trojan.Gen.MBT is the name Symantec products such as Norton give to a file they class as a generic trojan, and it is not a program you can uninstall. Check the file's path and origin, then follow the scan and removal steps.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If a Symantec or Norton alert for Trojan.Gen.MBT on a file keeps coming back after uninstalling, a scan can find what reinstalls it.
Do it yourself · free Remove Trojan.Gen.MBT yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Trojan.Gen.MBT: summary
| Type | A Symantec and Norton detection name for generic trojans; not a program name |
|---|---|
| Risk | Unknown for the name: no payload is documented. Cases range from false positives on developer tools to a malicious Word attachment. Treat as medium until the path and origin are checked |
| Symptoms | An alert from Symantec Endpoint Protection or Norton that names a file, sometimes with the file quarantined or deleted; no other sign in most cases we read |
| How to get rid of it | Check the path and origin, report a false positive, or use Safe Mode, a full scan, Windows Security, Microsoft Defender Offline, Windows updates and System Restore |
| Our check (6 October 2026) | No PC test: we read Broadcom's pages, five reader reports and Microsoft and Norton help pages; no sample was run |
| Running since / first seen | No vendor date; our first guide is from 21 March 2019 and the name is still in Broadcom's bulletins of 2 October 2026 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 9 more facts
| Detection | Symantec and Norton: Trojan.Gen.MBT. No Microsoft detection name is known for this label; other vendors name the same files differently, for example ESET DOC/TrojanDropper.Agent.AAC |
|---|---|
| Shown by | Symantec Endpoint Protection 14 and 14.3 and Norton in the reports we read |
| Not to be confused with | Trojan.Gen.2, Trojan.Gen and other generic labels, which are other detections |
| Name | Trojan.Gen.MBT |
| Evidence | 0 write-ups by security sites; details still limited |
| First seen | 21 March 2019 |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Broadcom's Symantec Endpoint Protection knowledge base and protection bulletins, five reader reports from 2021 to 2025, Norton's support page on false positives and four Microsoft Support pages. We ran no sample and tested no PC; the removal steps follow those pages and were not tried on a live infection. Not confirmed:
- what the letters MBT stand for
- any payload for the name
- how files with this name arrive in most cases
What Trojan.Gen.MBT is, and what it is not
Trojan.Gen.MBT is a name that Symantec security products, Symantec Endpoint Protection and Norton in the reports we read, show when they flag a file. It is not the name of one program, so you will not find it in the Apps list, and the name alone does not say what the file does.
- 1
Trojan
Broadcom's Symantec Endpoint Protection knowledge base describes Trojan horses as impostors: files that claim to be something desirable but are malicious. It says they do not replicate themselves the way viruses do, and that to spread, you must in effect invite them onto the computer, for example by opening an e-mail attachment.
- 2
Gen
The same article says the classifications Trojan Horse, Trojan.Gen and Trojan.Gen.2 are broad categories that cover a wide array of Trojan programs, while a name such as Trojan.Sload refers to a more specific family with particular behaviour. Trojan.Gen.MBT follows the Trojan.Gen pattern, so treat it as a catch-all label.
- 3
MBT
We found no Symantec or Broadcom page that spells out what the letters MBT stand for, so we do not guess. What we can say is what reports show: the label has been put on a developer's own tool, on a game's add-on files and on a malicious Word attachment.
- 4
What our 2019 guide got wrong
It said the file disguises itself as a useful application and, once opened, instantly spreads through the computer and alters many parts of the Windows configuration. A trojan does not replicate, according to the vendor's own article, and no source we read ties this name to changes in the Windows configuration. We rewrote those lines as what the reports show.
- Shown by
- Symantec Endpoint Protection and Norton in the reports we read; PCrisk's 2025 table lists it as Symantec's name for a malicious Word attachment
- Usual form
- Trojan.Gen.MBT, with no suffix; the alert names a file and often the word Auto-Protect or Real-Time Protection
- Platform
- Windows: every case we read is about a Windows file (.exe, .dll or a Word document)
- Is it a file?
- Yes: unlike a website alert, it names a path, for example a program folder or a game's bin folder
- Not the same as
- Trojan.Gen.2, Trojan.Gen.NPE or Microsoft's own Trojan:Win32/ names, which are other labels from other detection rules
The label tells you how one vendor classed a file, not what it does. The next chapters help you decide, from the path and where the file came from, whether the alert was right.
What Trojan.Gen.MBT does on an infected PC
Trojan.Gen.MBT next to the other Trojan.Gen names
Symantec products use several generic Trojan names that look alike. Only the first two rows below come from a vendor page; the rest is what we could and could not confirm.
| Name | What the vendor says | What it means for you |
|---|---|---|
| Trojan.Gen.MBT | No vendor page for this exact name found. Broadcom's protection bulletins list it among file-based protections (page read on 6 October 2026) | Look at the path and where the file came from before you decide |
| Trojan.Gen | Broadcom: a broad category that covers a wide array of Trojan programs | A catch-all; the name does not identify one threat |
| Trojan.Gen.2 | Broadcom: another broad category, listed in the same sentence as Trojan.Gen | A different label with its own alerts; its case is not this one |
| Trojan.Sload | Broadcom: an example of a specific family with a particular behaviour | A specific name says more than a Gen name; ours is not specific |
| Trojan.Sabsik!ATN, WS.Malware.1 | Names that appear beside Trojan.Gen.MBT in the same protection bulletin lists | Other Symantec labels; we found no page that explains them |
Because the label is generic, the same name has turned up on a malicious document and on an ordinary program that a developer made. That is why the chapters on false alarms and on removal are written to be read together.
What we checked on 6 October 2026, and what we could not
There is no website to test here and we did not run a sample. We read Broadcom's pages, five reader reports from 2021 to 2025 and Microsoft and Norton help pages, and we ran nothing on a PC.
Our reading of the sources, 6 October 2026
- The detection existsBroadcom's protection bulletins page lists Trojan.Gen.MBT among file-based protections in two bulletins dated 2 October 2026, so Symantec still uses the name. We read that page through an automated reader, not by hand.
- The alerts are real product messagesThe reports show Symantec Endpoint Protection and Norton quarantining or deleting named files: nimble.exe in 2021, SABnzbd.exe in 2023, ARF.DLL in 2024.
- What the file isNot known from the name. The vendor describes the Gen group as covering a wide array of Trojan programs.
- Real infection or false positiveNot settled by the name. Symantec removed the detection for SABnzbd.exe after a false positive report in December 2023, yet the same name sits on a malicious Word attachment in PCrisk's June 2025 table.
- What the letters MBT meanNot found in any vendor page we read.
- A clean second scanDoes not clear it. A file can be quarantined before it runs, and a clean rescan only says that nothing else matched at that moment.
Check where the file came from before you decide One detection can be a false alarm, a blocked download or the leftover of an infection. Write down the path, find out where the file came from, then follow the check and removal chapters. We tested nothing on a live PC, so a clean scan is one data point only.
How readers met the name, from 2019 to 2026
Our guide dates from 21 March 2019. The picture is from it, and the entries after it are reader and vendor pages we read for this rewrite.
21 March 2019
Our first guide
We described Trojan.Gen.MBT as a generic name for Trojan-family malware, with no file path or vendor page behind it.
31 May 2021
A developer's tool flagged
A user of the Nim programming language wrote that Symantec Endpoint Protection 14 quarantined nimble.exe from a Nim 1.4.8 install. He restored it and reported it to Symantec as a false positive; other posters thought vendors were reacting to malware written in Nim.
24 to 26 December 2023
SABnzbd.exe deleted, then cleared
A user running the SABnzbd 4.2.0rc2 Windows binary on Windows 10 22H2 saw Symantec Endpoint Protection 14.3 flag it a week after installing, and delete sabnzbd.exe, despite an old exclusion. Symantec replied to submission 351674 on 26 December that the detection would be removed from its products.
13 June to 6 July 2024
Add-on files of a flight simulator
Players of DCS World reported Norton flagging ARF.DLL in the F-15E folder and HeatblurJester.dll in the F-4E folder. One reported it to Symantec and Norton as a false positive on 24 June; support advised excluding the install folder and running a repair.
22 June 2025
A malicious Word attachment
PCrisk's page on an Order Placement e-mail lists Symantec's name for the attached document 20250606152642_OCA8771_RFQ.docx as Trojan.Gen.MBT, next to Avast's OLE:CVE-2017-11882 and ESET's DOC/TrojanDropper.Agent.AAC.
2 October 2026
Still in the vendor's bulletins
Broadcom's protection bulletins page lists the name among file-based protections for bulletins about the Vidar and Remus infostealers and about malicious KakaoTalk installers.
False alarm or real: what the reports show
A generic name can be right, early or wrong. These are the situations the reports describe and what to do in each.
| What you see | What is going on, from the reports | What to do |
|---|---|---|
| One alert on a program you installed from its maker | SABnzbd.exe in 2023 and nimble.exe in 2021 were flagged by Symantec and cleared by the vendor or the developer's report | Update the definitions, scan again and report the file to the vendor |
| Game or add-on files flagged in the install folder | ARF.DLL and HeatblurJester.dll were flagged in 2024; the developer's support advised excluding the folder and running a repair | Do not exclude anything until the vendor has said the file is clean |
| A document or file you did not expect, from an e-mail | PCrisk's table lists the name for a Word attachment that other vendors also flag as an exploit or dropper | Do not open it again; treat the PC as possibly infected and use the removal steps |
| The alert repeats within minutes or returns after reboots | Something keeps putting the file back or running it, which a false alarm on a single file would not do | Start the removal chapter and look at what starts with Windows |
| Other security tools find something too | On the Order Placement document, four vendors named the file, each with a different name | Take the alert seriously and check the file against other scanners |
What Trojan.Gen.MBT can steal or download
What a trojan of this kind can cost you
No source we read documents a payload for the name Trojan.Gen.MBT. The risks below are those of trojans in general, taken from our 2019 guide, and they are possibilities, not findings about every alert.
- High
Remote code execution and a place in a botnet
Our old guide said some infections can run code remotely, add the PC to a botnet and create administrator accounts. Any trojan that gets to run can do so, but we found no report that links these to this name.
- High
Stolen passwords, data and money
The old guide listed sensitive information gathering, a data leak and money loss. Treat passwords and bank sessions used on that PC as at risk until it is cleaned, if you ran the file.
- Medium
Other malware installed next
The old guide warned that a trojan can install other malware and compromise the machine further. In the 2025 case the document was called a dropper by ESET, a word for a file that brings in other files.
- Medium
Antivirus interference
Some malware tries to tamper with a security program, which is why the removal steps start in Safe Mode and add an offline scan.
- Low
Annoyances
The old guide said some trojans merely send you to affiliate sites for ad revenue, change the registry or show unwanted pictures. No report we read describes this for the name.
What you may notice, and what the reports show
Our 2019 guide said that in most cases no symptoms can be seen, although some people get error messages, crashes, redirects and slowdowns. Here is what the reports we read actually show.
| Sign | What we found |
|---|---|
| The alert itself | Reported in every case: a Symantec Endpoint Protection or Norton message naming a file, followed by quarantine or deletion |
| A program that stops working | SABnzbd.exe was deleted in 2023; in 2024 DCS World showed the F-15E and F-4E as not authorized after the add-on files were removed |
| The alert coming back | One 2024 poster wrote that the detection reappeared although the folder was excluded; that is his report, and nobody confirmed the cause |
| Redirects, slowdowns, pop-ups | Not reported with this name in any page we read; they are a reason to scan, not proof of this detection |
| Weeks of silence | Our 2019 guide said the infection can sit unseen for weeks or months. No source gives a time for this name; in the 2023 case the alert came a week after the install |
How to check the PC for Trojan.Gen.MBT
How a file with this name gets onto a PC
No vendor page we read says how files named Trojan.Gen.MBT arrive. These are the routes our 2019 guide gave and the ones the reports show.
- 1
An e-mail attachment
Our guide said phishing e-mails carry the file in an attachment or behind a link. The only report that shows this for the name is the 2025 Order Placement document, a Word file with a name that looks like a purchase request.
- 2
A download you chose
The old guide named repacked or cracked software, fake updates and drive-by downloads. For this name we found no case that proves it, but cracks and keygens are a common way for a trojan to get in, and our guide on them is the right next read.
- 3
Installed by other malware
The old guide said another infection can bring it in. That is how droppers work, and ESET's name for the 2025 document is Dropper, but no report shows it for a plain Trojan.Gen.MBT alert.
- 4
Nothing at all
The most common case in the reports is a program the user installed on purpose from its developer and a scan that flagged it later. Then the file is not an intruder, and the answer is a false positive report.
Check your PC before you delete anything
Write down exactly what the alert says before you click Quarantine, Delete or Allow: the detection name, the file path and the time. A forum helper or the vendor will ask for them.
- 1
Copy the alert
Take a screenshot. Note the full name, the file path and whether the product says it blocked the file, quarantined it or deleted it.
- 2
Open the history
In Norton or Symantec Endpoint Protection open the security history or quarantine list and note which items it took. The path taught the 2021 to 2024 readers more than the name did.
- 3
Ask where the file came from
A file in Downloads, Temp or AppData that you did not knowingly save is more worrying than one inside a program you installed on purpose. A path inside a program folder from a known maker points to a false positive.
- 4
Look for a second antivirus
Open Settings > Apps > Installed apps and look for another security product with live protection. Broadcom's article warns that two antivirus programs can report each other's signatures as a virus.
- 5
Look at what starts with Windows
Press Ctrl + Shift + Esc, open Startup apps, and note names you do not know. If the alert repeats, something is starting the file again.
- 6
Ask whether you ran something new
A document, installer or download from just before the first alert is the likeliest route. If you ran it, treat the PC as possibly infected and use the account steps further down.
How to remove Trojan.Gen.MBT
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Programs like Trojan.Gen.MBT add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Trojan.Gen.MBT, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Trojan.Gen.MBT that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Trojan.Gen.MBT can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove it from Windows 11 and Windows 10
Removing a real infection should come first, as our 2019 guide said, but only after you have checked that the file is not a program you installed on purpose. Do the steps in order and stop when a full scan is clean and the alert has not returned. We did not run them on a live infection; they follow Microsoft's pages and Broadcom's and Norton's advice.
- 1
Disconnect, then back up documents
Turn off Wi-Fi or unplug the cable. Copy documents and photos, not programs, to an external drive that you unplug afterwards.
- 2
Start in Safe Mode with Networking
Open the Windows Recovery Environment, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Microsoft says it adds the network drivers and services you need to reach the internet. Our old guide told readers to do this because some malware tampers with the antivirus.
- 3
Update and scan with your security product
Run the product's update (LiveUpdate in Norton), then a full scan. Norton's page says that if a false positive still appears after the updates and a full scan, you should report it. If the scan finds the file again, keep it in Quarantine and do not restore it.
- 4
Run a full scan with Windows Security
Open Windows Security > Virus & threat protection > Scan options, choose Full scan and Scan now. Any other well-known anti-malware program can be used as a second opinion, as the old guide said, as long as it comes from its maker's own site.
- 5
Run Microsoft Defender Offline
In the same Scan options choose Microsoft Defender Offline scan and Scan now. Microsoft says you will be signed out, Windows shuts down and the scan runs outside the usual Windows environment for about 15 minutes before it restarts. Review the result under Protection history.
- 6
Update Windows and change passwords
Open Settings > Windows Update and install everything offered. If you ran the file before the alert, change your passwords from a different device.
- 7
Try System Restore
If the alert began after a recent install, press Windows logo + R, type
rstrui.exeand choose a restore point from before it. Microsoft says System Restore reverts system files, registry settings and installed programs, and does not touch personal files. It will not help if no restore point exists. - 8
Last resort: reset Windows
Back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything. Restore documents only, no programs and no full system image.
Be careful with software that promises to clean a PC. Fake security programs exist, and a real removal never needs a phone number from a pop-up or a payment page before the scan.
Could it be a false alarm?
Possibly. Symantec removed its detection for SABnzbd.exe in December 2023 after a report, and users reported nimble.exe and ARF.DLL as false positives. Only the vendor can confirm that a file is clean.
| Points to a real infection | Points to a false positive |
|---|---|
| The path is in Downloads, Temp or AppData and you do not know the file | The path is inside a program you installed from its maker |
| The file came in an e-mail or from a crack or a keygen | The file is a developer's tool or a game's add-on that you installed on purpose |
| The alert repeats within minutes or after each reboot | The alert came once and the product quarantined or deleted the file |
| Other scanners name the file too | Only the Symantec engine names it, and an update stops it |
| Files were renamed, a note file appeared or the PC behaves strangely | The PC works normally and only the alert is odd |
- 1
Report it to the vendor
Norton's support page says to run LiveUpdate and a Full Scan first, and then report the false positive; the link depends on the exact alert you got. The SABnzbd user submitted the file on Symantec's site and had an answer the next day.
- 2
Wait for the update
Norton says the submitted file is analysed and updated definitions follow within 48 hours. Meanwhile keep updating and scanning the file at intervals.
- 3
Exclude only when you are certain
Norton lets you exclude a file or folder under Security > Advanced Security > Computer > Antivirus > Exclusions > Add, but only if you are sure the file is safe or you are its developer. One 2024 poster wrote that the detection came back despite an exclusion, so an exclusion is not proof of safety.
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed A Symantec or Norton alert for Trojan.Gen.MBT on a file in the list of installed apps, a sign of a program that could read browser data, the clean-up is only half of the work. The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
If it was real: what to do about your accounts
The scans above deal with the PC. These steps deal with what a trojan could have seen, and they matter most if you ran the file before the alert.
- 1
Change passwords from another device
Email first, then banking, then everything else. Turn on two-step sign-in. Do this before you use banking on the infected PC.
- 2
Sign out everywhere
Use the sign out of all sessions option in your Google, Microsoft and social accounts so stolen cookies stop working.
- 3
Check your money
Look at card statements and any wallets for payments you did not make.
- 4
Look for ransomware signs
Check whether documents were renamed or a note file appeared. If so, do not pay and do not reinstall yet; identify the family first.
- 5
Scan again in a week
A clean scan today does not clear everything. Run another full scan and a Defender Offline scan a week later, and keep the alert screenshot.
Keep trojans off your PC
Our 2019 guide said that infections are not luck and that users' own actions are usually what lets malware in. That still holds; here is the advice with current details.
Do
- Keep one security product with live protection on. Microsoft Defender and the Windows Firewall are built into Windows 11 and 10.
- Install Windows Update monthly, and update browsers, Office and PDF readers as soon as patches come out.
- Open attachments only when you expected them and the sender's address matches. Be as careful with .docx and .pdf as with .exe, .vbs, .js and .scr files.
- Use a password manager, strong passwords and two-step sign-in on every account.
- Download programs from their makers' sites or the Microsoft Store, and choose Custom or Advanced when an installer offers it, so extra programs do not come along.
- Turn off Remote Desktop when you do not use it, and protect it with a strong password when you do.
- Keep a backup of documents on a disk you unplug (File History or OneDrive).
Don't
- Do not run cracks, keygens or cracked software.
- Do not rely on an ad blocker alone; it cuts down bad ads, but it does not scan files.
- Do not keep Adobe Flash Player: Adobe stopped supporting it on 31 December 2020 and advises uninstalling it.
- Do not run two antivirus programs with live protection at once.
- Do not restore a quarantined file or add an exclusion until a vendor says it is clean.
- Do not call a number shown in an alert.
Trojan.Gen.MBT is a Windows detection. A phone or a tablet is not a place where this alert comes from, so a message with this name on a phone is more likely a scam page than a real scanner.
Questions about Trojan.Gen.MBT
What is Trojan.Gen.MBT?
Trojan.Gen.MBT is a detection name that Symantec security products, including Symantec Endpoint Protection and Norton, show when they flag a file as a generic trojan. It is not a program you can uninstall. Broadcom's knowledge base calls the Trojan.Gen group broad categories covering a wide array of Trojan programs, so the label does not tell you what the file does.
We found no vendor page that explains the letters MBT. The reports we read range from a developer's own tool to a malicious Word attachment, so check the file's path and origin before you decide.
Is Trojan.Gen.MBT a virus or a false positive?
It can be either, and the name alone cannot tell you which. Symantec removed its detection for SABnzbd.exe in December 2023 after a user reported it, and users flagged nimble.exe in 2021 and the DCS World files ARF.DLL and HeatblurJester.dll in 2024.
On the other hand, PCrisk's June 2025 page lists the name for a malicious Word attachment that Avast and ESET also flagged. Check the path first: a file inside a program from its maker points to a false positive, a file from an e-mail points to a real one.
How do I remove Trojan.Gen.MBT from Windows 11 or 10?
Disconnect and back up documents, start in Safe Mode with Networking, then update your security product and run a full scan. Follow with a full scan in Windows Security and a Microsoft Defender Offline scan, and install all Windows updates.
If you ran the file, change your passwords from another device. System Restore can help if the alert began after a recent install. We did not test these steps on a live infection; they follow Microsoft's help pages and the vendors' advice.
Is it safe to restore the file or add an exclusion?
Not until a vendor has said the file is clean. Norton's support page says you can exclude a file or folder when you are sure it is safe or you are its developer, and it lists the path Security, Advanced Security, Computer, Antivirus, Exclusions.
A 2024 poster wrote that the detection came back although he had excluded the folder, so an exclusion does not prove a file is harmless. Keep the file in Quarantine, report it as a false positive, and wait for the updated definitions.
How do I report a false positive to Symantec or Norton?
Run LiveUpdate and a Full Scan first, then submit the file through the link that Norton's support page gives for your alert; the link depends on the exact detection. Norton says the file is analysed and updated definitions follow within 48 hours.
The SABnzbd user filed a submission on Symantec's site on 25 December 2023 and got a reply on 26 December that the detection would be removed from its products. Keep the file name, the path and a screenshot of the alert with your report.
Why does my antivirus keep detecting Trojan.Gen.MBT again?
Something keeps putting the file back or starting it. It may be a program that reinstalls its own files, such as a game's repair tool, or a real infection that copies itself from a startup entry.
Open Startup apps in Task Manager, look at the path in the alert and see whether the file belongs to a program you installed. If it does not, run the removal steps, including the offline scan. If it does, report the file to the vendor as a false positive.
Does Trojan.Gen.MBT steal passwords or install other malware?
The name alone does not say. Our 2019 guide listed information gathering, other malware installs, botnet use and money loss as possible results of trojans in general, and Broadcom says trojans can cause loss or even theft of data when triggered.
No report we read ties those effects to this exact name. If you ran the file before the alert, assume the worst:
- change passwords from another device
- sign out of your accounts
- check your money
- scan again a week later
Can other antivirus programs show Trojan.Gen.MBT?
Not under this name. Trojan.Gen.MBT is a Symantec label, and other vendors name the same file differently. On PCrisk's Order Placement page, Avast called the document OLE:CVE-2017-11882, ESET called it DOC/TrojanDropper.Agent.AAC, Kaspersky called it Trojan.Win64.Agent.smejwv and Symantec called it Trojan.Gen.MBT.
Microsoft uses its own Trojan:Win32/ names. If only one product flags a file and others do not, a false positive becomes more likely, but it is not proved.
Will a VPN or a Mac or Android security app help against Trojan.Gen.MBT?
No. A VPN hides your connection, it does not clean a file already on your PC, and our 2019 guide's VPN pitch is not a removal step.
Trojan.Gen.MBT is a Windows detection, so Mac and Android security apps are not part of the answer, and a message with this name on a phone is more likely a scam page. The fix is the file check, the scans in Windows Security and the offline scan, and a report to the vendor if the file is yours.
Will Fortect remove Trojan.Gen.MBT?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Trojan.Gen.MBT, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Broadcom Knowledge Base: Difference between viruses, worms, and trojans (article 178186, updated 1 September 2025) (read October 6, 2026)
- Broadcom: Protection Bulletins (page lists Trojan.Gen.MBT among file-based protections, 2 October 2026) (read October 6, 2026)
- Nim forum: Nimble detected as Trojan.Gen.MBT by Symantec Endpoint Protection v14 (31 May 2021) (no longer online) (read October 6, 2026)
- GitHub, sabnzbd/sabnzbd: false positive - malware / Trojan.Gen.MBT, discussion 2757 (25 and 26 December 2023) (read October 6, 2026)
- ED Forums (DCS World): F-15E not authorized, page 2 (13 to 24 June 2024) (read October 6, 2026)
- ED Forums (DCS World): F4 has disappeared (July 2024) (read October 6, 2026)
- PCrisk: Order Placement Email Virus (22 June 2025) (read October 6, 2026)
- Norton Support: Respond to incorrect Norton alerts that a file is infected (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Support: System Restore (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)
- Microsoft Support: Virus and threat protection in the Windows Security app (read October 6, 2026)
- Adobe: Flash Player End of Life (read October 6, 2026)