Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →If you suspect you’ve been infected with a trojan, don’t keep browsing and downloading “fixes.” Trojans often persist by modifying startup entries, browser policies, or scheduled tasks—so the first scan you run might not actually remove the thing that’s re-infecting you.
This guide walks you through a safe, methodical trojan removal process across Windows, macOS, and mobile. You’ll learn what to do first, how to confirm the infection, and how to clean persistence so the problem doesn’t return.
As an Amazon Associate I earn from qualifying purchases.
What a Trojan virus usually does (and why normal scans may miss it)
A trojan is malware that hides inside something you trust—an installer, a cracked app, a fake “security update,” or even a phishing attachment. Once running, it may steal passwords, modify files, enable remote access, or download additional payloads.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTwo reasons “quick scans” can fail:
- Persistence: the trojan reinjects itself via a startup entry, scheduled task, browser extension/policy, or a malicious service.
- Execution context: the payload may only run after reboot, when a specific process starts, or only if network access is available.
Before you remove anything: protect yourself and your data
Act like credentials are already compromised. Even if you’re not sure, this approach prevents extra damage.
#1 Best Overall
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
- Disconnect from the internet. Unplug Ethernet or turn off Wi‑Fi to stop downloads and command-and-control traffic.
- Stop risky actions. Don’t log into banking/eBay/YouTube accounts while you’re unsure. Avoid password managers that auto-fill.
- Back up safely. If you need files, back up only personal documents/photos. Avoid copying hidden system folders.
- Record what you see. Note the exact alert message, time of infection, and any unusual programs installed.
Identify the symptoms and confirm it’s a trojan (not a false alarm)
Start with observable behavior. Trojans commonly show up as one or more of these:
- Unknown apps installed around the same time you downloaded something.
- Browser redirects, new extensions, homepage changes, or “managed by your organization” warnings.
- Unexpected startup items, scheduled tasks, or high CPU/network usage.
- Antivirus alerts mentioning trojan families (or generic detections like “Trojan:Win32/…”).
False positives happen. If your security software flags something, save the name and detection ID. Later, you’ll use the exact filename/path and the hash (if provided) to verify removal.
Windows: remove a trojan virus with offline scanning and persistence cleanup
On Windows, the winning strategy is: isolate → scan offline → remove persistence → verify on reboot. Do this in order.
1) Isolate and prevent immediate reinfection
- Disconnect from Wi‑Fi/Ethernet.
- Open Task Manager (Ctrl+Shift+Esc) and sort by CPU and Memory.
- Note any suspicious processes (random-looking names, processes using unusual paths like
C:\Users\<you>\AppData\Roaming).
2) Run Microsoft Defender Offline (strong default)
Microsoft Defender Offline is designed to scan without Windows fully running—often the difference between “it finds it” and “it fixes it.”
- Open Windows Security.
- Go to Virus & threat protection.
- Select Scan options.
- Choose Microsoft Defender Offline scan.
- Click Scan now and reboot when prompted.
3) Remove what remains in normal mode
- After reboot, return to Windows Security > Virus & threat protection.
- Run a Full scan (not Quick scan).
- Allow removals; if something can’t be removed, note the filename and detection name.
4) Clean persistence (where trojans love to hide)
Trojan removal isn’t just deleting a file. Check these common persistence points:
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
- Startup apps: Settings > Apps > Startup (or Task Manager > Startup apps).
- Scheduled tasks: Task Scheduler > Task Scheduler Library.
- Services: Look for unknown services and paths in services.msc.
- Browser persistence: Extensions, policies, and default search/home changes.
Practical approach:
- In Task Manager, right-click a suspicious process > Open file location.
- If the path is in AppData/Temp or looks random, treat it as high risk.
- In Startup and Task Scheduler, disable entries that reference that path.
5) Scan with a second opinion tool
Even high-quality antivirus can miss a loader/payload. Use a reputable second scanner to confirm and remove what the first missed.
- Install the tool of your choice (preferably from the vendor site).
- Run a Full scan.
- If it finds the same suspicious filename/path, remove it and reboot.
6) Verify after reboot
- Confirm the suspicious file no longer exists at the exact path.
- Re-check Startup tasks and scheduled tasks.
- Monitor network activity for 10–15 minutes. Sudden repeated outbound connections can indicate remnants.
macOS: remove a trojan virus using built-in security and malware scanners
macOS trojans commonly abuse fake installers, browser extensions, or persistence through Launch Agents/Daemons.
Free tools Windows power users keep installed
One-click scans. No signup required.
1) Unplug and identify unusual apps
- Disconnect from Wi‑Fi.
- Open Activity Monitor and sort by CPU and Network.
- Note any processes you don’t recognize or that run from
~/Libraryor/tmp.
2) Use built-in security checks
- Go to System Settings > Privacy & Security.
- Review Security settings and ensure you didn’t accidentally allow a malicious profile.
- Check Login Items for unknown entries (System Settings > General > Login Items).
3) Remove Launch Agents/Daemons (common persistence)
Trojan persistence on macOS often lives in user-level Launch Agents:
~/Library/LaunchAgents/Library/LaunchDaemons
- In Finder, go to the folders above.
- Look for recently added
.plistfiles tied to unknown apps. - Move suspicious
.plistfiles to Trash only if you’re confident they’re malicious.
If you’re unsure, leave them in place and proceed to scanning first.
4) Scan with a reputable macOS malware scanner
- Use a well-known malware scanner for macOS.
- Run a full system scan.
- Follow the tool’s removal instructions, then reboot.
5) Browser cleanup
- Remove suspicious browser extensions.
- Check browser homepage and search settings.
- Quit the browser and re-open after removal to ensure policies are gone.
iPhone and iPad (iOS): what you can and can’t do
iOS trojans are typically delivered via malicious profiles, enterprise apps, or social-engineering scams rather than direct system-file infection.
Rank #3
![Norton 360 Premium 2027 Antivirus, 10 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41JNWru8mYL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 10 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
- Delete the suspicious app.
- Go to Settings > General > VPN & Device Management and remove unknown profiles.
- Check Settings > Notifications for suspicious push sources.
If behavior persists (battery drain, constant redirects, unknown account activity), consider changing your Apple ID password and enabling two-factor authentication in Apple ID settings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Android: remove a trojan virus and stop notification scams
Android trojans often rely on malicious apps with overlay permissions, accessibility services, or notification spam.
1) Safe-mode and app removal
- Reboot to Safe Mode (power menu method varies by brand).
- Go to Settings > Apps and uninstall apps you don’t recognize or that were installed around the time you noticed problems.
2) Revoke high-risk permissions
- Check Settings > Accessibility and disable suspicious services.
- Check Special access (or “Apps with special access”) for Appear on top and revoke for unknown apps.
- Review notification permissions and block spammy sources.
3) Run a mobile security scan
- Install a reputable mobile security app.
- Run a full scan.
- If it finds a malicious app, remove it and reboot.
After removal: verify, rotate credentials, and harden your device
Trojan infections frequently involve credential theft, even if you didn’t notice anything obvious.
Credential rotation checklist
- Change your email password first (it’s the root for password resets).
- Change passwords for banking and password-sensitive accounts.
- Revoke active sessions and log out on all devices in services that support it.
- Turn on two-factor authentication (2FA) using an authenticator app where possible.
System hardening to prevent re-infection
- Keep OS and browser updated (Windows Update, macOS updates).
- Remove cracked software and unknown installers.
- Enable real-time protection and automatic definition updates in your security software.
- Use an ad/tracker blocker in the browser if you’re dealing with redirect-type infections.
Tools you can use (and how to choose them)
Use tools that do three things well: detection, remediation (removal), and persistence cleanup. A “scanner only” app isn’t enough if you need to stop startup tasks and browser policies.
| Tool type | What it helps with | When to use it |
|---|---|---|
| Built-in AV with offline scan | Root-level file scanning without Windows fully running | First response on Windows |
| Second-opinion malware scanner | Confirming detections and catching what the first missed | After the initial cleanup |
| Anti-malware/anti-rootkit tools | Detecting persistence and deeper implants | If persistence remains after removal |
| Cleanup for browser policies/extensions | Removing hijackers and managed policies | If you see redirects, homepage changes, or new extensions |
If you tell me your exact OS version (Windows 10/11 build, macOS version) and the filename/path mentioned in alerts, I can help you pick the most efficient tool path.
Recommended Free Tools
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Edge cases and common gotchas
- “Trojan” detected, but nothing removed: sometimes the file is locked or the scan didn’t run offline. Re-run with offline scan (Windows Defender Offline) or scan from safe mode.
- Multiple payloads: you may remove the downloader but still have the persistence mechanism. That’s why scheduled tasks and startup items matter.
- Browser infections: if you only delete the extension but not policies, the browser may reapply changes. Check managed settings.
- Untrusted browser “notifications”: on both desktop and mobile, trojans can be blamed when the real issue is notification spam permissions.
Troubleshooting when the trojan won’t go away
If the issue returns after reboot, assume persistence until proven otherwise.
1) Re-check persistence using the file path
Use the exact suspicious filename/path from the detection alert. Search your system for that filename and look for scheduled tasks or services referencing it.
2) Use offline or safe mode scans again
- Windows: re-run Microsoft Defender Offline scan.
- macOS: reboot and scan with a full system scanner; check Launch Agents again.
3) Look for browser extension “clones”
Malicious browser extensions sometimes come back in disguise. After removal, check extension lists again and verify homepage/search settings didn’t revert.
4) Consider that you’re dealing with a second infection
Some trojans download additional malware after initial cleanup. A second-opinion scan usually reveals the full chain.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →When it’s time to wipe and reinstall
If you keep finding reinfection indicators or you can’t trust any running system, wiping is the cleanest solution.
Best Value
- POWERFUL, LIGHTNING-FAST ANTIVIRUS: Protects your computer from viruses and malware through the cloud; Webroot scans faster, uses fewer system resources and safeguards your devices in real-time by identifying and blocking new threats
- IDENTITY THEFT PROTECTION: Protects your usernames, account numbers and other personal information against keyloggers, spyware and other online threats targeting valuable personal data
- REAL-TIME ANTI-PHISHING: Proactively scans websites, emails and other communications and warns you of potential danger before you click to effectively stop malicious attempts to steal your personal information
- ALWAYS UP TO DATE: Webroot scours 95% of the Internet three times per day including billions of web pages, files and apps to determine what is safe online and enhances the software automatically without time-consuming updates
Wipe is justified when:
- You can’t remove the suspicious persistence mechanism despite offline scans.
- Your system repeatedly flags the same trojan on reboot.
- You suspect keylogger behavior (copied clipboard content, typed credentials appearing elsewhere).
Before wiping, back up only personal files you can verify are safe. Then reinstall the OS and restore only from trusted backups.
FAQs
How do I know if my trojan is actually gone?
Assuming your scanner says “removed,” confirm in three ways: (1) the suspicious file/path no longer exists, (2) the related startup task/service is disabled or deleted, and (3) the detection doesn’t reappear after a reboot.
Can I remove a trojan virus without reinstalling Windows or macOS?
Often, yes—especially if you run an offline scan and clean persistence (startup apps, scheduled tasks, Launch Agents). Reinstall is the “last resort” when persistence can’t be trusted.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsShould I trust random trojan removal websites?
No. Many “fixers” are themselves malware or scare you into downloading more payloads. Only use reputable security tools from their official vendors, and prefer built-in protections like Microsoft Defender Offline.
Will resetting my browser settings remove the trojan?
It can remove browser hijacking symptoms, but it doesn’t usually remove system-level persistence. Reset helps when the trojan’s only visible behavior is browser changes.
What if my antivirus keeps detecting the same trojan file?
That’s a persistence flag. Re-run offline scanning, then search for scheduled tasks, services, and startup items referencing that exact path. If it still returns, you may need an incident response approach or a full wipe.
Bottom Line
To genuinely remove a trojan virus, you need more than a quick scan: isolate the device, run an offline-capable scan, then clean persistence (startup apps, scheduled tasks, services, and Launch Agents where applicable). After that, verify across reboot and rotate sensitive credentials.
If you share the OS version and the exact trojan alert name/filename/path, I can tell you the most likely persistence point and the fastest next step for your situation.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
