Remove a Remote Access Trojan from Windows PC

This guide walks you through detecting and removing a Remote Access Trojan (RAT) from a Windows PC. A RAT gives an attacker remote control over your computer, so the goal is to cut that connection, delete the malicious files, and secure the system against reinfection. You’ll need a second device to download tools if your PC is heavily compromised.

What You’ll Need

A second computer or smartphone with internet access (for downloading tools and researching)
A USB flash drive (at least 4 GB) to transfer tools if the infected PC’s browser is hijacked
An external hard drive or cloud storage for backing up personal files
Windows installation media (USB or DVD) as a last resort – you can create this on another PC

Step-by-Step

Disconnect from the internet. Unplug the Ethernet cable or turn off Wi-Fi. This immediately severs the attacker’s remote connection and prevents further data exfiltration or file encryption.
Boot into Safe Mode with Networking. Restart the PC, press F8 (or Shift + Restart from the login screen) during boot, and select Safe Mode with Networking. This loads only essential drivers and services, making it harder for the RAT to start automatically.
Back up your personal files. Copy documents, photos, and other important data to an external drive or cloud storage. Do not back up program files or system folders – only your own data. Scan the backup with an antivirus later.
Run a full system scan with Windows Defender. Open Windows Security (search for it in the Start menu), go to Virus & threat protection, and click Scan options. Choose Full scan and let it complete. Quarantine or remove anything it finds.
Use a second opinion scanner. Download Malwarebytes AdwCleaner or the free version of Malwarebytes on another device, transfer it via USB, and run a scan. These tools catch Trojans and adware that Windows Defender might miss.
Check startup programs and services. Press Ctrl + Shift + Esc to open Task Manager, go to the Startup tab, and disable anything you don’t recognize. Also press Win + R, type services.msc, and look for suspicious services – especially ones with random names or no description. Right-click and stop them, then set their startup type to Disabled.
Review installed programs. Go to Settings > Apps > Installed apps. Uninstall anything you didn’t install or that appeared recently. Pay attention to toolbars, “optimizers,” or programs with misspelled names.
Check network connections. Open Command Prompt as administrator and run netstat -b -n. Look for connections to unfamiliar IP addresses, especially on ports like 4444, 6666, or 1337. If you see a suspicious connection, note the PID (process ID) and then find it in Task Manager. End that process.
Clear browser extensions and reset settings. In Chrome, Edge, or Firefox, go to the extensions page and remove anything unfamiliar. Reset the browser to default settings if the homepage or search engine changed.
Change all passwords from a clean device. After removal, change passwords for email, banking, social media, and any other accounts. Use a different computer or phone, and enable two-factor authentication where possible.
Update Windows and all software. Install the latest Windows updates, and update your browsers, Java, Flash, and other plugins. Many RATs exploit outdated software.
Run a final scan. After everything is clean, run another full scan with Windows Defender and Malwarebytes to confirm nothing remains.

Common Mistakes

Staying online during removal. The attacker can reinstall the RAT or lock you out if you remain connected. Disconnect first.
Only running one scanner. No single tool catches everything. Using two different scanners significantly improves detection.
Ignoring startup entries. RATs often survive by adding themselves to startup. If you skip this step, the Trojan returns after reboot.
Not changing passwords. Even after removal, the attacker may have captured credentials. Change them all.
Reusing the same USB drive without scanning. If you used a USB to transfer tools, scan it before using it on a clean PC.

Tips

Use a live bootable antivirus rescue disk if Windows won’t start or the infection is stubborn. Create it on another PC with tools like the Windows Defender Offline or a Linux live USB.
Keep your operating system and software updated automatically. Most RATs exploit known vulnerabilities.
Use a standard (non-admin) account for daily use. Many RATs require admin rights to install deeply.
Enable “Controlled folder access” in Windows Security to block unauthorized changes to your documents.
Consider a clean Windows reinstall if you have any doubt about the removal – it’s the only 100% sure method.

Troubleshooting

If the RAT reappears after reboot: You likely missed a startup entry or service. Boot into Safe Mode again, check Task Manager Startup, and use Autoruns (from Microsoft Sysinternals) to see every startup item. Also check scheduled tasks – RATs often hide there.
If you can’t boot into Safe Mode: Use Windows Recovery Environment (WinRE) by holding Shift while clicking Restart. If that fails, use a Windows installation USB to access “Repair your computer.”
If the scanner crashes or freezes: The RAT may be interfering. Boot into Safe Mode (without Networking) and try again. Or use a rescue disk that boots independently of Windows.
If you suspect keylogging but scans are clean: Check for hardware keyloggers (small USB devices) and review running processes in Task Manager. Also check browser autofill entries – they may contain typed passwords.
If you can’t remove a file because it’s “in use”: End the process in Task Manager first, or boot into Safe Mode to delete it. You can also use a tool like Unlocker (but be careful with unknown software).
If the system is completely locked or ransomware appears: Do not pay. Disconnect immediately and seek help from a professional or a dedicated ransomware decryption tool if available.

Frequently Asked Questions

How did I get a RAT in the first place?

RATs are usually installed via phishing emails with malicious attachments, fake downloads, or exploit kits that target unpatched software. Sometimes they come bundled with pirated software or “cracks.”

Can a RAT hide from antivirus software?

Yes. Many RATs are designed to be stealthy, using rootkit techniques or encrypting their code. That’s why using multiple scanners and checking startup entries is important.

Should I pay a ransom if the RAT leads to ransomware?

No. Paying doesn’t guarantee you’ll get your files back, and it funds the attackers. Restore from backups or seek professional help.

Is it enough to just delete the RAT file?

Usually not. The RAT may have created registry entries, scheduled tasks, or additional files. You need to remove all components and then secure the system.

Can I remove a RAT without losing my files?

Yes, in most cases. The steps above preserve your personal files. However, if the infection is deep or you’re not confident, a clean install is safer – but you’ll need to back up your data first.

How do I know if my PC is still infected?

Watch for unusual network activity, new programs appearing, mouse movements without input, or high CPU usage. Run a full scan with two different tools and check netstat for suspicious connections.

General steps for current mainstream versions; menus can differ by device and version. See the disclaimer or report an error.

More in this bed

The whole Tech How-To bed →