File scan report
Verdict Suspicious
Is Clear
The script tampers with Defender history and quarantine using elevated PowerShell, but only Kaspersky flags it and no corroborated malware family or network activity appears.
Read the whole reasonShow less
Why Suspicious? One antivirus engine (Kaspersky) flags it and one of our detection rules matched it.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
1 of 61 flagged
- Flagged 1
- No detection 60
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
5 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This command script performs high-risk administrative actions: it elevates PowerShell, invokes dynamically evaluated code, uses a scheduled task, and removes Defender history, quarantine, and engine-database files. Kaspersky alone identifies Persik among 75 engines, while broader prevalence and the absence of corroborating sandbox, file it created, network, or malware-specific YARA evidence leave intent unresolved.
The strongest concern is observed tampering with Windows Defender records and quarantine, which can erase evidence and remove quarantined material. Elevated PowerShell, Invoke-Expression, and scheduled-task activity reinforce that concern, although PowerShell execution itself is not proof of malware. Kaspersky is the only one of the 61 antivirus engines that checked it to report a Persik trojan label, so there is no family consensus. The sandbox recorded no malicious verdict, and its only listed domain was explicitly attributed to analysis-environment background traffic rather than the sample. Established prevalence across 102 submitters and the lack of malware-specific external-intelligence hits make a false positive plausible, but not enough to overlook the script's endpoint-protection tampering.
What We Detected
Kaspersky was the sole detector among 75 engines, assigning the label UDS:Trojan.PowerShell.Persik. No strong major family consensus formed, and no malware-specific YARA rule or malicious file it created corroborated that label.
Threat Behavior
The completed sandbox run observed an elevation request, PowerShell using Invoke-Expression, scheduled-task activity, and commands deleting Microsoft Defender scan history, quarantine contents, and engine-database files. These are risky administrative operations because they can destroy security records and interfere with normal remediation. The only listed domain was marked as analysis-machine background traffic, so it is not attributed to the script; no sample-originated network activity was recorded.
What To Do Now
Do not run the script on a production computer unless its contents and source have been independently verified and the Defender cleanup is specifically authorized. Keep security software enabled; use documented Defender settings or management tools for legitimate history-retention changes instead of deleting security databases and quarantine folders directly.
Where this verdict could be wrong3 caveats
- Only 1 of the 61 antivirus engines that checked it flagged the script, and the named Persik family lacks multi-engine or strong major consensus.
- The file has broad, established prevalence—102 submitters and 118 submissions—rather than being or exceptionally rare.
- No sandbox run produced a malicious verdict, no malware-specific YARA rules matched, and no inspected child had a saved malicious verdict.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only one of the 61 antivirus engines that checked it flagged the file, with no strong family consensus.
- The sample has been submitted by 102 sources 118 times and is roughly 355 days old.
- The completed sandbox run did not return a malicious verdict.
- No malware-specific YARA rules or corroborating external-intelligence hits were recorded.
- None of the three inspected dropped files had a saved malicious verdict, although their individual verdict coverage is incomplete.
- The script deletes Microsoft Defender scan-history, quarantine, and engine-database files.
- It requests administrator privileges and executes PowerShell through Invoke-Expression.
- It invokes scheduled-task tooling, which can support recurring execution or persistence.
- Kaspersky identifies the script as Trojan.PowerShell.Persik.
- Its name presents the security-impacting action as routine cleanup, although the commands reach into protected Defender data.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 8spawned processes
- 0network contacts
- 38filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Listed the programs running on the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Note: Checked which security software was installed on the test computer.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as creating a scheduled task; none was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
ClearDefenderHistory.cmd
d1ee84596066eec095a6e8edf4d7a1c00c0dde77bfc1f2d6424b776fd2102be3
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
cmd.exe
"C:\Windows\system32\cmd.exe" /c start /wait "" "C:\Users\<USER>\Desktop\install.bat"
Test run - Evidence 3 of 5: ProcessSeen in the test run
cmd.exe
C:\Windows\system32\cmd.exe /K "C:\Users\<USER>\Desktop\install.bat"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
ModuleAnalysisCache
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Test run - Evidence 5 of 5: Written fileSeen in the test run
DWDH
C:\Windows\System32\Tasks\DWDH
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
Includes 13 mapped techniques, every process, file, registry and network entry and 2 dropped files.
Show the technical evidenceChapter 04
Technical details
1 of the 61 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
- Kaspersky (major engine)UDS:Trojan.PowerShell.Persik
File fingerprint
- Last analyzed
- Oct 15, 2026, 7:32 AM UTC
- SHA-256
d1ee84596066eec095a6e8edf4d7a1c00c0dde77bfc1f2d6424b776fd2102be3- SHA-1
38fba51e3f49f797ba8b935fc1fc87161b5efc03- MD5
62c839a357979b71159c942f3e83e032
About this file
ClearDefenderHistory.cmd is a Powershell file of 2.0 kB.
- Type and size
- Powershell · 2.0 kB
- Signer
- Not applicable
- First seen
- Oct 25, 2025On VirusTotal.
- Submitted by
- 102 distinct sources
First scanned
Includes every engine result (75), 2 matched signature rules and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is ClearDefenderHistory.cmd safe, or is it malware?
What is ClearDefenderHistory.cmd?
How many antivirus engines detected ClearDefenderHistory.cmd?
What should I do if I already ran ClearDefenderHistory.cmd?
What is the SHA-256 hash of ClearDefenderHistory.cmd?
How up to date is this analysis of ClearDefenderHistory.cmd?
Community
Member reviews and reports for this exact file hash.