Detect and Remove a Discord RAT from Windows

This guide shows you how to spot and remove a Remote Access Trojan (RAT) that spreads through Discord. You’ll learn the warning signs, how to manually clean your system, and how to secure your account afterward. No special tools are required, just a standard Windows PC and a few minutes of focused work.

What You’ll Need

Windows administrator account access
A web browser to download security tools
An antivirus or antimalware program (Windows Defender is sufficient)
Patience—manual removal can take 20–30 minutes

Step-by-Step

Disconnect from the internet. Unplug your Ethernet cable or turn off Wi-Fi. This stops the RAT from sending your data or receiving commands while you clean.
Open Task Manager. Press Ctrl + Shift + Esc. Look for any process with names like “discord.exe”, “update.exe”, “java.exe”, or random strings of letters/numbers. A RAT often disguises itself as a Discord-related process. Right-click suspicious entries and choose “Open file location” to see where they live.
Check Startup programs. In Task Manager, go to the “Startup” tab. Disable anything you don’t recognize, especially if it references Discord or has no publisher name.
Run a full antivirus scan. Reconnect to the internet, then open Windows Security (or your AV). Choose “Virus & threat protection” → “Scan options” → “Full scan”. Let it run to completion. If it finds a threat, quarantine or delete it.
Use a second opinion scanner. Download and run Malwarebytes (free version) or HitmanPro. These catch RATs that traditional AV might miss. Do a full system scan and remove anything flagged.
Manually delete suspicious files. If you found a file location in step 2, navigate to it in File Explorer. Look for files with random names or recent creation dates. Right-click → “Delete”. If the file is locked, restart in Safe Mode (hold Shift while clicking Restart → Troubleshoot → Advanced options → Startup Settings → Restart → press 4) and delete it there.
Clean the registry (optional but recommended). Press Win + R, type regedit, and go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run. Look for entries pointing to the suspicious files you found. Right-click and delete them. Be careful—only remove entries you are sure are malicious.
Reset Discord tokens. The RAT may have stolen your Discord token (a login key). Open Discord, go to User Settings → Authorized Apps, and revoke access to anything you don’t use. Then change your Discord password and enable two-factor authentication (2FA) under “My Account”. This logs out all sessions and invalidates stolen tokens.
Check Discord’s own files. In Discord, go to User Settings → Advanced and click “Reset Cache” and “Reset Data”. This clears any injected scripts. Also check the Discord installation folder (usually %appdata%\discord) for odd files like index.js or core that you didn’t create.
Restart and re-scan. Reboot your PC, then run both scans again. If they come back clean, you’re likely safe. If not, repeat steps 5–7 or consider a clean Windows reinstall.

Common Mistakes

Only deleting the downloaded file. The RAT runs from a different location after execution. You must remove the running process and its persistence entry, not just the installer.
Skipping the offline step. If you stay connected, the attacker can re-infect you or wipe your files before you clean up.
Trusting a single antivirus. No AV catches everything. Always use a second scanner.
Ignoring the Discord token. Even after removing the RAT, the attacker still has your token. You must reset it by changing your password and enabling 2FA.
Deleting legitimate Discord files. Don’t remove everything in the Discord folder—only files that look out of place. When in doubt, search the filename online.

Tips

Keep Windows and all software updated. RATs often exploit old vulnerabilities.
Never click on links or download files from strangers in Discord, even if they appear to be friends—their account may be compromised.
Enable 2FA on your Discord account right now. It’s the single best defense against token theft.
Use a dedicated, limited user account for daily tasks instead of an administrator account.
Regularly review your Discord “Authorized Apps” and remove anything unused.
Consider using a password manager to generate unique passwords for every service.

Troubleshooting

If the RAT keeps coming back after removal: The attacker may have a backdoor that reinstalls it. Boot into Safe Mode with Networking and run the scans again. If it persists, your system may be too compromised—back up your personal files (excluding executables) and perform a clean Windows install.

If you can’t delete a file because it’s “in use”: The RAT is still running. Open Task Manager, find the process, right-click and “End task”. If that fails, use a tool like Process Explorer (from Microsoft) to force-kill it, or boot into Safe Mode as described earlier.

If your antivirus won’t run: The RAT may have disabled it. Try running Malwarebytes in Safe Mode. If it still won’t open, download the portable version onto a USB drive from another computer and run it from there.

If you see strange Discord messages sent from your account: Your token is still valid. Immediately change your password and enable 2FA. This will invalidate all sessions and tokens.

Frequently Asked Questions

What exactly is a Discord RAT?

A Remote Access Trojan is a type of malware that gives an attacker remote control over your computer. In the Discord context, it’s usually spread via malicious files or links in chat, and it often steals your Discord login token.

How did I get a RAT from Discord?

Most commonly, you clicked a link that downloaded a file (like a game cheat or a free Nitro generator) that contained the RAT. Sometimes it’s hidden in images or videos that exploit a browser vulnerability.

Can a RAT be hidden in a Discord image or video?

Technically yes, but it’s rare. Modern RATs are usually executable files (.exe, .scr, .bat) disguised as something benign. Discord’s own file scanning catches most malicious uploads, so the risk is lower than on other platforms.

Will resetting my Discord password remove the RAT?

No. Changing your password only revokes the stolen token; it does not remove the malware from your computer. You must follow the removal steps above.

Is it safe to log back into Discord after cleaning?

Yes, but first change your password, enable 2FA, and revoke any suspicious authorized apps. After that, logging in is safe.

Do I need to reinstall Windows to be sure?

Not always. If scans come back clean and you’ve removed all persistence entries, you’re likely fine. But if the RAT is sophisticated or you can’t find it, a clean install is the only way to be 100% certain.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →