A Trojan rarely announces itself. It arrives tucked inside a cracked installer, a "shipping invoice" attachment, or an update prompt you never asked for, then settles in quietly: a fake svchost, a scheduled task, a Run key that restarts it at every boot. When your antivirus misses it — or the same alert reappears every morning — manual removal is the next step. It takes patience and a keyboard, but it works. Here is how to hunt one down yourself.

Before You Start: Contain the Damage

Pull the network cable or disable Wi-Fi first. A Trojan that cannot reach its command server cannot receive new instructions, download extra modules, or upload what it has already collected. Leave the machine offline until you are finished.

Write down what you are seeing before you change anything: the popup text, the process name in Task Manager, the time it appeared. These details tell you which files to chase.

Copy your documents, photos and personal files to an external drive. Do not back up executables, installers, or anything from a Temp folder — you may be archiving the infection.

If this computer was used for online banking, email, or work accounts, assume those credentials are compromised. Change the passwords from a different, clean device — phone or another PC — and enable two-factor authentication where you can.

Finally, understand the limit of this approach. Manual removal handles the common Trojans that live in user folders and startup entries. Rootkits, bootkit components and skilled banking malware can hide below the level you can see from within Windows. If money or business data is involved, a clean reinstall is the honest answer, not a heroic registry hunt.

Boot Into Safe Mode

Most Trojans survive by loading something at startup. Safe Mode loads a minimal set of drivers and services, so those persistence tricks frequently break — which makes the malware easier to delete and stops it from immediately recreating itself.

On Windows 10 and 11, hold Shift while clicking Restart. Then go to Troubleshoot > Advanced options > Startup Settings > Restart and choose option 4 (Safe Mode) or 5 (Safe Mode with Networking). If the malware blocks the recovery menu — some do — a rescue USB is the alternative, though that goes beyond a pure manual cleanup.

Find the Process That Doesn't Belong

Open Task Manager with Ctrl+Shift+Esc, switch to the Details tab, right-click the column header and add Command line. Now look for patterns:

• Random names such as x7f3q.exe, svch0st.exe, or a misspelled explorer.exe running from the wrong folder.
• Executables running out of %APPDATA%, Downloads, Temp or ProgramData rather than Program Files.
• rundll32.exe or regsvr32.exe with a strange file argument pointing to a user folder.
• A process called svchost.exe whose path is anything other than C:\Windows\System32.

Right-click a suspect file in File Explorer, open Properties, and check the Digital Signatures tab. Legitimate system tools are signed; unsigned files sitting in Temp are not. Also sort folders by Date modified — Trojans usually leave a cluster of files created at the same moment.

Note the full path of anything you flag. Do not start killing processes blindly; you will only crash Windows and lose your trail.

Cut the Persistence Points

Deleting an executable is pointless if something restarts it. Check these four places in Safe Mode:

1. Registry Run keys. Press Win+R, type regedit, and inspect HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run and the same path under HKEY_LOCAL_MACHINE. Export a backup of any key before you edit it, then delete values pointing to files you have verified as malicious.
2. Startup folders. Type shell:startup and shell:common startup in the Run box. Anything there whose name you do not recognise gets moved out.
3. Task Scheduler. Open taskschd.msc, expand the Task Scheduler Library, and read the Actions tab of each task. Scheduled tasks rebuilt by malware often run a file from AppData or Temp.
4. Services. Open services.msc, check the properties of unfamiliar services, and look at Path to executable. A service launching from a user folder is almost always hostile.

Sweep the Usual Hiding Places

Now clear the payload itself. Check these locations and look for recent, oddly named executables:

• %APPDATA% and %LOCALAPPDATA% — paste them into the Explorer address bar.
• %TEMP% and C:\Windows\Temp.
• C:\ProgramData and C:\Users\Public — both are writable without administrator rights, which is why malware likes them.
• Your Downloads folder, and every subfolder of AppData\Roaming with a random name.

Rename a suspect file to filename.exe.bak instead of deleting it outright. That breaks the infection while leaving a way back if you misjudged a legitimate program. Then check the hosts file at C:\Windows\System32\drivers\etc\hosts for lines pointing well-known sites at 127.0.0.1.

Clean Up the Damage It Left Behind

Open each browser and remove extensions, toolbar add-ons and search providers you did not install. Right-click browser shortcuts on the desktop, open Properties, and check the Target field — some Trojans append a redirect URL after the program path. Delete everything after .exe.

In Registry Editor, press Ctrl+F and search for the malicious file name; remove matching keys, but never delete a key you cannot explain. When you are done, run sfc /scannow from an administrator command prompt to repair system files the Trojan may have altered.

When Manual Removal Isn't Enough

Two built-in options are worth trying if the Trojan survives. Windows Security includes an offline scan, which restarts the machine into a minimal environment and looks for malware that hides from an active Windows session. System Restore can also roll the machine back to a point before the infection, though it will not save documents or remove files created afterwards. If neither works — or if the machine handles work accounts, banking or client data — reset Windows with Remove everything or reinstall from clean media. It is inconvenient, but it is the only method that gives you certainty.

Keeping It Out Next Time

Leave Windows Defender running even if you install other security software, and apply Windows and browser updates promptly. Treat cracked software, unexpected invoice attachments and "update this player" popups as hostile until proven otherwise, and use a standard rather than administrator account for daily browsing. If the infection involved money, accounts or business documents and you are not confident the cleanup was complete, pay a technician to verify it — that is a far cheaper conversation than the one that follows a stolen bank account.

Photo: cottonbro studio / Pexels