How to Remove a Trojan Virus from Windows (Step by Step)
A trojan is malware that disguises itself as something legitimate - a cracked game, a fake installer, a “codec” you needed for a video. Once it runs, it can open a backdoor, steal data, or pull down more malware. The good news: most consumer trojans on Windows can be removed with built-in and free tools if you follow the steps in order. Here’s how to do it carefully.
Signs you may have a trojan
- Your PC is suddenly slow, with fans spinning hard while idle.
- Unknown programs start at boot, or your firewall flags outbound connections you didn’t make.
- Security tools get disabled or won’t open.
- Files appear or disappear, or settings change on their own.
None of these alone confirms a trojan, but together they’re a strong hint that a scan is overdue.
Step 1 - Disconnect from the internet
If you suspect an active trojan, disconnect from Wi-Fi or unplug the Ethernet cable. Many trojans phone home to a command-and-control server to receive instructions or exfiltrate data. Cutting the connection limits the damage while you clean up. Reconnect only when you need to download tools or updates.
Step 2 - Boot into Safe Mode with Networking
Safe Mode loads Windows with a minimal set of drivers and services, which often stops the malware from running and makes it easier to remove.
- Open Settings → System → Recovery and click Restart now under Advanced startup.
- After the reboot, go to Troubleshoot → Advanced options → Startup Settings → Restart.
- When the list appears, press 5 (or F5) for Safe Mode with Networking.
Networking lets you update your scanners; if you already have everything downloaded, plain Safe Mode is fine.
Step 3 - Run a full Microsoft Defender scan
Windows includes Microsoft Defender Antivirus, which is capable against common trojans.
- Open Windows Security → Virus & threat protection.
- Click Scan options, choose Full scan, and run it.
- For stubborn infections, use Microsoft Defender Offline scan - it reboots and scans before Windows fully loads, catching malware that hides at runtime.
Quarantine or remove anything it detects.
Step 4 - Get a second opinion with Malwarebytes Free
No single engine catches everything, so run a second scanner. Malwarebytes Free is a well-known on-demand cleaner that’s good at catching what general antivirus misses.
- Download it from the official site (malwarebytes.com).
- Run a scan, review the detections, and quarantine them.
- Reboot when prompted.
Step 5 - Remove suspicious programs and startup entries
After scanning, check for leftovers:
- Apps: Go to Settings → Apps → Installed apps and uninstall anything you don’t recognize or didn’t install.
- Startup: Open Task Manager → Startup apps and disable unfamiliar entries that launch at boot.
Don’t delete things you’re unsure about - search the exact name first so you don’t disable a legitimate Windows component.
Step 5b - Check the persistence mechanisms scanners often leave behind
This is the step most guides skip, and it is the reason infections come back a week later. Removing the malicious file is not the same as removing what restarts it. A trojan usually installs at least one mechanism whose only job is to bring it back.
There are four places worth checking by hand, in this order.
Scheduled tasks. Open Task Scheduler (taskschd.msc) and look through Task Scheduler Library. You are looking for tasks with meaningless names, tasks that run a program from a user folder such as AppData or Temp, and tasks that trigger every few minutes. Legitimate software does schedule tasks, so read the Actions tab to see exactly what a task launches before touching it.
Services. Open services.msc and sort by name. A service pointing at an executable outside C:\Windows or C:\Program Files deserves a second look. Note the name and search it before disabling anything, because Windows itself runs a great many services with unhelpful names.
Run keys in the registry. In regedit, check HKCU\Software\Microsoft\Windows\CurrentVersion\Run and the equivalent under HKLM. These launch a program at every sign-in. Export the key before deleting anything, so you can restore it if you remove the wrong entry.
Browser extensions. A trojan that harvested your session cookies often installs an extension to keep reading traffic. Review the extension list in every browser you use, not just your main one.
If any of this feels beyond your comfort level, stop here and go to the clean reinstall section. Deleting the wrong service or registry key can leave Windows unbootable, which is a worse outcome than the trojan.
Step 6 - Reboot, reconnect, and re-scan
Restart into normal mode, reconnect to the internet, install the latest Windows updates, and run one more full scan with Defender. A clean result on a fresh scan after a reboot is your confirmation that the trojan is gone.
Step 7 - Secure your accounts
Trojans frequently steal saved passwords and session cookies. Once your PC is verified clean:
- Change passwords for your important accounts (email first - it’s the recovery hub for everything else) from a device you trust.
- Turn on two-factor authentication everywhere it’s offered.
- Review your email for any rules or forwarding the attacker may have added.
A password manager makes rotating dozens of credentials far less painful, and using one means you’re not reusing the same password across sites.
How to tell it is actually gone
“The scan came back clean” is weaker evidence than it sounds, because a scanner only finds what it recognises. Three checks are worth doing a few days later.
Watch the outbound connections. Close your browser and everything else you can, then run netstat -bn in an elevated Command Prompt. You are looking for a process you do not recognise holding a connection open. A machine that is genuinely idle should be close to silent.
Re-check the persistence points. Go back through the scheduled tasks and Run keys from Step 5b. If an entry you deleted has reappeared, something on the machine put it back and the infection is still active.
Watch the accounts, not just the PC. Sign-in alerts from unfamiliar locations, mail rules you did not create, or password reset emails you did not request are all signs that credentials taken before the cleanup are still being used. That damage lives on servers, not on your disk, and no local scan will show it.
Why the cleanup sometimes fails
A few mistakes account for most of the cases where a trojan comes straight back.
Reconnecting too early. If you go back online before the cleanup is finished, an active trojan can simply download a fresh copy of itself.
Scanning only in normal mode. Some malware protects its own files while Windows is running normally. This is exactly what Safe Mode and the Defender Offline scan are for.
Restoring the infection from a backup. If your backup was taken after the infection started, restoring it restores the trojan. Restore individual documents rather than an entire system image when you can, and scan them.
Changing passwords from the infected machine. If a keylogger is still running, you have just handed over the new passwords too. Use a phone or another computer.
Stopping at the first clean scan. Run a second full scan after a reboot, on a different engine if possible.
When to consider a clean reinstall
If scans keep finding the same threat, security tools won’t run, or you suspect a rootkit-level trojan, the safest path is to back up your personal files (not programs), then reinstall Windows from official media. It’s more work, but it guarantees a clean slate when removal tools can’t fully evict the infection.
Take the steps in order - disconnect, Safe Mode, scan twice, clean up, re-scan, secure accounts - and most trojans come off without a full reinstall.
Related reading: Brontok Removal · 292 Fake GitHub Repos Are Serving an Infostealer