Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
For most Windows 10 and Windows 11 PCs, Microsoft Defender Antivirus is the best first-line choice for detecting and removing a remote access trojan (RAT). Keep its definitions current, leave cloud-delivered protection and automatic sample submission enabled, and use Microsoft Safety Scanner as an on-demand second opinion when a normal scan is inconclusive. Defender Offline or the Malicious Software Removal Tool can help with persistent or active malware. Malwarebytes is another remediation scan, but no product can guarantee detection of every RAT—especially when an attacker uses legitimate remote-control software, stolen credentials, or a modified payload.
A clean scan also does not prove that nobody accessed the computer. If you suspect a RAT, contain the device, recover accounts from a separate trusted device, and preserve evidence before deleting files.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
At a glance
| Name | Best for | Key spec | Platforms | Checked |
|---|---|---|---|---|
| Microsoft Defender Antivirus | Continuous protection on a personal Windows PC | Built-in real-time antivirus; Microsoft lists it for detecting and removing trojans | Windows 10 and 11 | Nov 2026 |
| Microsoft Safety Scanner | Second-opinion, on-demand removal scan | Free Microsoft scanner for detecting and removing trojans; not a replacement for real-time protection | Windows | Nov 2026 |
| Defender Offline and MSRT | Persistent, active, or difficult infections | Offline or targeted cleanup tools; MSRT focuses on active prevalent malware | Windows | Nov 2026 |
| Malwarebytes | Additional remediation scan | Vendor-supported scan for RAT-related files and registry changes; no RAT-specific independent benchmark cited | Windows-focused use in the cited guidance | Nov 2026 |
Which antivirus is best for a remote access trojan?
Use Microsoft Defender Antivirus as the baseline, then escalate to Microsoft Safety Scanner, Defender Offline, or MSRT when the first scan does not resolve the problem. Add Malwarebytes when you want a separate vendor’s remediation scan. This ranking is based on each tool’s documented role, availability, and the evidence in the cited guidance—not on a universal RAT benchmark, because no such common test set is available.
1. Microsoft Defender Antivirus: best everyday baseline
Defender is integrated into Windows 10 and 11 and provides the practical combination most people need: real-time monitoring, signature and cloud intelligence updates, and on-demand scans. Microsoft explicitly lists Defender Antivirus among its free tools for detecting and removing trojans in its antivirus and antimalware FAQ.
Popular on Amazon
For new or rapidly changing threats, Microsoft says cloud-delivered protection and automatic sample submission improve the chance of detection. In Windows Security, open Virus & threat protection, choose Manage settings, and verify that Real-time protection, Cloud-delivered protection, and Automatic sample submission are enabled. Keep Tamper protection on unless an administrator has a documented reason to change it.
Defender is not a guarantee against a RAT. A file-based trojan may be detected and quarantined, while an attacker using a legitimate remote-support utility, a stolen sign-in session, or a newly modified payload may leave little for a traditional file scan to identify.
2. Microsoft Safety Scanner: best on-demand second check
Safety Scanner is useful when Defender’s normal scan is incomplete, when a detection needs confirmation, or when you want a separate on-demand pass. Microsoft identifies it as a free option for detecting and removing trojans, but also states that it is not a replacement for a real-time antimalware product. Treat it as a supplemental check, not as the protection that runs continuously in the background.
Download the current Safety Scanner from Microsoft’s support guidance, run it with administrator privileges, and select the most thorough scan available. Save the result before closing the tool. Because malware definitions and the scanner itself change, obtain a fresh copy when you need another investigation rather than relying on an old download.
3. Defender Offline and MSRT: best for stubborn or active malware
Defender Offline restarts the computer into a trusted scanning environment, which can prevent a running malware process from hiding files or blocking security services. It is an appropriate escalation when a threat repeatedly returns, Windows Security cannot complete a scan, or you suspect that malware is actively interfering with Windows.
Also popular on Amazon
Microsoft’s Malicious Software Removal Tool (MSRT) is a different, targeted utility. Microsoft describes MSRT as focusing on active prevalent malicious software, including viruses, worms, and Trojan horses. It cannot remove malware that is not running, so a clean MSRT result does not establish that every dormant file, persistence mechanism, or stolen credential is gone. Use the MSRT documentation to understand that scope.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →4. Malwarebytes: best as an additional remediation opinion
The cited RAT-scanner guidance describes Malwarebytes as an additional vendor-supported remediation option for RAT-related files and registry changes. It can be useful when Defender finds nothing but suspicious behavior continues, or when a second vendor’s view would help you decide whether to rebuild the machine.
Do not present Malwarebytes as a proven RAT winner. The available evidence is vendor guidance rather than a controlled, RAT-specific comparison. Running two real-time antivirus products simultaneously can create conflicts; use an on-demand scan or follow the products’ documented compatibility instructions instead of stacking competing real-time engines.
What exactly does a remote access trojan do?
A RAT is malware that gives an attacker remote control and surveillance capabilities after it is installed. Microsoft explains that trojans can download additional malware, record keystrokes and websites, send passwords and browsing history to a hacker, and provide control of the device. Its trojan-malware overview also describes how apparently legitimate software can trick a person into installing the malicious component.
That makes a RAT an account and privacy incident, not merely an unwanted executable. Possible consequences include captured email credentials, browser sessions, password-manager unlocks, screenshots, microphone or webcam access, data theft, and use of the PC to attack other systems. The exact capabilities depend on the RAT and the permissions it obtained.
Also popular on Amazon
Antivirus products are strongest when there is a recognizable malicious file, behavior, or persistence change. They are less decisive when the attacker logs in through an approved remote tool, reuses a stolen session cookie, or modifies code enough to evade current signatures. A clean scan therefore narrows the possibilities; it does not prove that unauthorized access never happened.
How should you configure Defender before scanning?
Start with a current, fully updated Windows installation and an internet connection long enough for Defender to obtain the latest intelligence. Then:
- Open Windows Security from the Start menu.
- Select Virus & threat protection and install any available protection-intelligence or platform updates.
- Open Manage settings and confirm real-time protection, cloud-delivered protection, automatic sample submission, and tamper protection are enabled.
- Choose Scan options. Use a Full scan when you can leave the computer running; use a Microsoft Defender Offline scan when you suspect active interference or repeated reinfection.
- Review Protection history after the scan. Record the detection name, affected path, action taken, and timestamp.
Do not sign in to banking, email, a password manager, or workplace systems from a computer that may be controlled. If the device belongs to an employer or school, contact the responsible administrator before making changes that could destroy useful evidence.
How do you scan a Windows PC for a RAT?
Use a staged process rather than repeatedly launching the same quick scan. The goal is to contain the suspected access, obtain a second opinion, and preserve enough information for recovery.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Isolate the suspected computer when practical. Disconnect Wi-Fi or the network cable if you need to stop ongoing remote control. Do not keep using it for sensitive logins.
- Run Defender’s full scan. Let it finish, quarantine confirmed malware, and export or photograph the result. A scan that stops early is not a clean result.
- Run Microsoft Safety Scanner. Download a current copy from Microsoft’s malware-removal troubleshooting guidance, run it as an administrator, select its thorough scan, and save the report.
- Escalate to Defender Offline. Use the offline option if the threat returns, security settings are being changed, or Windows cannot complete a normal scan. Expect a restart and save work first.
- Use MSRT for active-malware coverage. Interpret a clean result narrowly: MSRT targets active prevalent malware and cannot remove non-running malware.
- Obtain a separate remediation opinion if needed. A Malwarebytes scan can add another vendor’s view of suspicious files and registry changes. Avoid running multiple real-time engines together.
- Check for unauthorized remote software and accounts. Review installed applications, startup entries, scheduled tasks, local users, browser extensions, and remote-desktop settings. An approved remote-support product can be abused, so confirm ownership and authorization with your administrator.
- Recover accounts from a trusted device. Revoke active sessions where the service provides that option, rotate passwords, and enable multifactor authentication. Do this from a known-clean phone or computer, not from the suspected PC.
What do independent antivirus results tell you about RAT protection?
AV-Comparatives’ March 2026 Malware Protection Test used 10,000 recent malware samples on a fully updated Windows 11 system. It evaluated on-access and on-demand scanning offline and online, then allowed behavioral protection to act when a sample was not stopped before execution.
Also popular on Amazon
| Product in the test | Reported online protection | What the number means here |
|---|---|---|
| Norton | 99.97% | Broad malware-protection result, not a RAT-specific rate |
| Bitdefender | 99.94% | Broad malware-protection result, not a RAT-specific rate |
| ESET | 99.93% | Broad malware-protection result, not a RAT-specific rate |
| Microsoft | 99.93% | Broad malware-protection result, not a RAT-specific rate |
| Malwarebytes | 99.59% | Broad malware-protection result, not a RAT-specific rate |
These figures are useful context for general malware protection, but they cannot establish which product detects more RATs. The test did not use a publicly defined common RAT sample set, and AV-Comparatives cautions readers not to choose solely on one test or one test type. A RAT that arrives as a conventional malicious file may be covered by such defenses; a legitimate remote tool operated by an intruder is a different detection problem.
Why can a RAT evade antivirus software?
RAT incidents often combine malware with valid credentials and ordinary administration tools. A remote-control application may be signed, widely deployed, and permitted by policy, so its presence alone is not proof of infection. An attacker who steals a browser session or password can also access services without placing a classic trojan file on the computer.
Other evasion techniques include packing or modifying the payload, delaying execution, using memory-resident components, abusing scheduled tasks or registry run keys, and disabling security controls. Behavioral protection and cloud intelligence can improve detection, but no scanner sees every event or reconstructs every past session.
Look for corroborating evidence: unexpected remote sessions, unfamiliar administrator accounts, new startup items, changed security settings, unexplained webcam or microphone activation, password-reset emails you did not request, or logins from unfamiliar locations. Security logs and endpoint telemetry may be needed when the consequences matter.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should you do after a RAT is detected?
Removal is only one part of recovery. Follow this order:
Also popular on Amazon
- Stop sensitive activity on the device. Do not enter new passwords, payment details, recovery codes, or work data.
- Contain it. Disconnect network access if that is safe and consistent with your organization’s incident process.
- Use a separate trusted device for account recovery. Change email, password-manager, financial, workplace, and administrator passwords. Do not reuse old passwords.
- Revoke sessions and tokens. Sign out other sessions, remove unknown app authorizations, rotate API keys, and regenerate recovery codes where the service supports those actions.
- Notify the responsible administrator. For a work, school, family-shared, or managed computer, report the detection before deleting files or reinstalling Windows.
- Preserve evidence. Keep the detection name, file path, timestamps, scan logs, screenshots, and any suspicious email or download that preceded the event.
- Choose eradication or rebuild. A verified quarantine may be sufficient for a straightforward file detection. If the attacker had administrator access, persistence is uncertain, or credentials were exposed, an administrator may choose a clean reinstall and restoration from known-good backups.
- Monitor after recovery. Watch account alerts, login history, endpoint detections, and network activity. Removing one file does not reset credentials, revoke stolen sessions, or prove that an intruder’s access has ended.
Which tool should you choose in common situations?
| Situation | Recommended next action | Reason and limitation |
|---|---|---|
| No specific symptoms; you want baseline protection | Keep Microsoft Defender enabled and updated | It is built into Windows 10/11 and provides continuous protection |
| One suspicious download or an incomplete normal scan | Run Microsoft Safety Scanner on demand | It adds a separate removal pass but does not replace real-time protection |
| Threat returns, scan is blocked, or malware appears active | Run Defender Offline, then consider MSRT | Offline scanning can reduce interference; MSRT only targets active prevalent malware |
| Defender is clean but behavior remains suspicious | Run Malwarebytes as a separate remediation opinion and investigate logs | A second scan may expose files or registry changes, but no RAT-specific benchmark proves superiority |
| Evidence of stolen accounts or administrator access | Contain, notify an administrator, recover accounts from a clean device, and assess a rebuild | Antivirus cleanup alone cannot undo credential theft or session hijacking |
How we picked these recommendations
The shortlist prioritizes documented trojan-detection and removal roles, practical availability on Windows 10 and 11, the ability to perform an on-demand or offline second check, and clear limitations. It does not claim a universal RAT detection winner because the research contains no independent head-to-head test using a common RAT set. General malware test results are shown only as context, and every performance figure is attributed to AV-Comparatives rather than presented as a hands-on result.
Is a paid antivirus required to remove a RAT?
No. Microsoft’s free Defender, Safety Scanner, Defender Offline, and MSRT cover the baseline and escalation paths described here. A paid product may add centralized administration, support, or other features, but payment alone does not solve the harder problems of legitimate remote-tool abuse, stolen credentials, or an attacker who already has a valid session.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsFrequently Asked Questions
Can a RAT come back after antivirus quarantines it?
Yes. Reinfection can occur through a second persistence mechanism, a malicious scheduled task, a compromised account, or a still-infected backup. Check startup locations and accounts, rotate credentials from a clean device, and involve an administrator when persistence or privileged access is possible.
Should I reinstall Windows after every RAT detection?
Not necessarily for a simple, well-documented file detection that was quarantined before execution. A clean reinstall becomes more defensible when the RAT had administrator privileges, the detection keeps returning, logs are incomplete, or you cannot establish what the attacker changed.
Can legitimate remote-desktop software be mistaken for a RAT?
Yes. Remote-support and remote-desktop tools have legitimate uses and may not trigger antivirus. Verify whether the software is approved, who installed it, which accounts can connect, and whether connection logs show unauthorized sessions.
Is changing my password on the infected computer safe?
No. A RAT may capture the new password, session cookie, or multifactor code. Use a separate trusted device, revoke existing sessions, and then change passwords and recovery details.
Recommended Free Tools
What evidence should I save before deleting a detected RAT?
Save the detection name, file path, timestamps, scan reports, screenshots, suspicious messages or downloads, and relevant login alerts. On an employer- or school-managed device, ask the administrator for instructions first so cleanup does not destroy forensic evidence.
