Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →A Trojan disguises malicious software as something legitimate so a person—or another program—installs it. Once running, it may steal information, install more malware, enable fraud, or give an attacker control of the device. Antivirus software looks for Trojans using several layers: known-threat signatures, suspicious code or behavior, and—in some products—memory, script, machine-learning, and cloud analysis. No single method guarantees detection.
What a Trojan is—and how it gets onto a device
A Trojan is malware that masquerades as a legitimate file, app, or other content. Microsoft describes it as malware that, unlike a worm, “can’t spread on [its] own.” A person may download it believing it is a real application, or other malware may download and install it. Some Trojans use names that resemble genuine apps. Microsoft’s guidance notes, “It’s easy to accidentally download a trojan thinking that it’s a legitimate app.” Microsoft’s Trojan overview was last updated October 29, 2024.
As an Amazon Associate I earn from qualifying purchases.
That dependence on installation is the key distinction from a worm, which can spread between systems without a person installing each copy. A Trojan may arrive inside a deceptive download, but the label describes how it gets a foothold—not necessarily what it does afterward.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat a Trojan can do after installation
Different Trojans have different payloads. Possible actions include:
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
- Installing additional malware.
- Recording keystrokes or the websites a person visits.
- Stealing passwords, sign-in details, or other information.
- Facilitating fraud.
- Giving an attacker control of the infected device.
These are possible behaviors, not a checklist every Trojan performs. The goal depends on the particular malware and its operator.
How antivirus software recognizes Trojans
Antivirus detection is layered: software can compare files with known threats, look for suspicious traits, monitor activity, and use local or cloud-based analysis. The exact combination varies by product. The methods below describe general detection concepts where noted, alongside capabilities Microsoft documents specifically for Defender Antivirus.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Known-threat signatures
A signature is a recognizable characteristic associated with known malware. Antivirus software can compare files against signatures to identify known threats; some altered variants may also retain recognizable characteristics. NIST’s 2013 Guide to Malware Incident Prevention and Handling explains that signatures are not effective against completely new malware when no matching signature exists. That limitation is one reason detection uses additional methods, and one reason NIST advises keeping antivirus software and signatures updated.
Heuristics and suspicious traits
Heuristic detection looks beyond an exact match. It may search a file for suspicious code sequences or run it in a virtual environment to observe unusual actions. These methods can flag a file that looks or acts like malware even when it does not match a known signature, but a suspicious trait is evidence to assess—not proof by itself.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Behavior and process monitoring
Behavior-based protection watches what files and processes do. Microsoft says Defender Antivirus monitors file and process behavior; its technical overview describes a behavior engine that observes processes after execution and cloud behavior models that analyze suspicious sequences and attack techniques. This can provide evidence that a static file scan would not show.
Memory and script analysis
Some threats try to hide their activity through obfuscation or by operating in ways that are less visible in a file scan. Microsoft describes Defender Antivirus as scanning process memory to expose activity hidden by code obfuscation. It also documents script analysis before and after execution through the Antimalware Scan Interface (AMSI), with machine-learning models used in that analysis. These are Microsoft-described Defender capabilities; they should not be assumed to exist in every antivirus product. See Microsoft’s overview of Defender Antivirus technologies.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Cloud analysis and machine learning
Microsoft documents local and cloud detection engines, and says cloud-delivered protection helps identify new and emerging threats. A historical example illustrates how those layers can work together: Microsoft’s Defender Security Research Team reported that behavior signals combined with cloud-powered machine learning blocked more than 80,000 instances during the Dofoil coin-mining campaign on March 6, 2018. That is a Microsoft-reported result from one campaign, not a general detection rate or a current product benchmark. Microsoft’s account of the Dofoil campaign was published March 7, 2018.
How the detection approaches differ
| Approach | What it examines | Strength and limitation |
|---|---|---|
| Signature matching | Known characteristics of files or malware | Useful for known threats and some recognizable variants; cannot match completely new malware without a known signature. NIST, 2013. |
| Heuristics | Suspicious code traits or activity observed in a virtual environment | Can identify suspicious files without an exact known-threat match; suspicious behavior is not, on its own, proof of infection. NIST, 2013. |
| Behavior monitoring | File and process activity, including activity after a process starts | Adds evidence from what software does; Microsoft documents this capability in Defender Antivirus. |
| Memory and script analysis | Process memory and script behavior before or after execution | Can help expose obfuscated activity; Microsoft documents these as Defender capabilities, not universal features. |
| Cloud and machine-learning analysis | Local findings and cloud-delivered intelligence or models | Can contribute evidence about emerging threats; results depend on the product and should not be inferred from one historical campaign. |
These methods complement rather than replace one another: an exact signature can efficiently identify a known threat, while behavior or other analysis can provide signals when a file is unfamiliar or disguised.
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Symptoms that may warrant a scan
Unexpected windows, unusual network connections flagged by a firewall, and slower-than-usual performance can be signs of malware. They are nonspecific clues, not a diagnosis: other problems can cause similar behavior, and symptoms vary by threat. Microsoft’s Trojan:Script/Wacatac threat description, updated January 8, 2026, lists examples while noting that symptoms vary.
What to do if you suspect a Trojan on Windows
Microsoft’s Trojan guidance names Microsoft Defender Antivirus and Microsoft Safety Scanner for detecting and removing Trojans on Windows. These are Microsoft’s recommendations, not a comparative ranking of antivirus products. For Windows 11, Microsoft describes Defender as integrated with cloud-delivered protection and including real-time, behavior-based, and heuristic capabilities; details can vary by Windows version and configuration. See Microsoft’s Windows Security overview.
- Run a scan with Microsoft Defender Antivirus. Follow Microsoft’s instructions for your Windows version to check for and remove detected threats.
- If you need another Microsoft scanning option, use Microsoft Safety Scanner. Microsoft lists it as a detection and removal tool in its Trojan guidance.
- Keep antivirus protection and its updates current. Updated signatures help identify known threats; other detection layers may add evidence when a threat is not yet known.
Detection capabilities differ between products and platforms. The Windows guidance above should not be read as proof that every operating system has identical tools or protection. The evidence cited here also does not establish a current independent detection-rate comparison across consumer antivirus vendors, so it does not support ranking them.
Recommended Free Tools
In security writing, “Trojan” can also refer to a backdoor inserted into an AI model, a separate topic from Trojan malware on a device. NIST discusses that distinct meaning in Trojan Detection Evaluation: Finding Hidden Behavior in AI Models.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
