How to Remove a Trojan Virus in 2026: Step-by-Step for Windows and Android
Trojans are one of the most dangerous types of malware. Like the legendary Trojan Horse, it disguises itself as something harmless but secretly opens a back door into your system for hackers.
In this article, we’ll show you how to spot a malicious program on your system and remove it safely and completely without leaving any malicious files behind.
Trojans are difficult to detect. Common warning signs include a slowed-down system, antivirus software that suddenly turns off, or unusually high network traffic to an unknown address.
Disconnect the device from the internet right away once you confirm the threat. This stops the malware from sending or receiving more data.
Boot your system in safe mode and run a full scan with your built-in antivirus software. Running a second malware scanner provides an extra layer of protection.
Prevent another infection: keep your system up to date, use good antivirus software, and don’t open suspicious attachments or links.
Spotting the Warning Signs: Is It Really a Trojan?
Trojans are masters of disguise, and their goal is to stay hidden as long as possible. They pose as harmless files or programs, then quietly run malicious code on your system once you open them.
To spot one, you need to look closely. Many warning signs also have perfectly ordinary causes, like a full hard drive or outdated drivers. But if you notice several at once, there’s a good chance you’re dealing with malware.
The following signs can (but don’t always) point to a trojan or other malicious software:
Your PC suddenly slows down and responds with a delay
Updates stop working
Unknown processes show up in Task Manager
Antivirus software won’t start anymore or turns itself off
Unexpected outbound network traffic
Your browser homepage changed on its own
Files and folders disappear or change
If you have a specific suspicion, this guide gives you additional tips on how to detect a trojan on your system:
How to Remove a Trojan Virus Step by Step
Have you confirmed a trojan is behind your device’s problems? Don’t panic. In most cases, you can remove the malware without reinstalling your entire operating system.
Just follow our step-by-step guide:
Disconnect From the Internet and Back Up Your Data
First things first: disconnect your device from the internet or unplug the ethernet cable. This stops the trojan from receiving new commands or sending out your data. To be safe, turn off Bluetooth too.
In Windows 11, you’ll find the Wi-Fi switch under “Start” → “Settings” → “Network & internet”:
Turn off WLAN (Wi-Fi) in your network settings.
To turn off Bluetooth, go to Settings and open “Bluetooth & devices”:
Turn off Bluetooth in Settings under “Bluetooth & devices.”
Next, back up your important data to an external storage device, such as a USB drive or external hard drive.
Start in Safe Mode
Next, start your device in safe mode. This matters because safe mode loads only essential Windows services, preventing many trojans from starting automatically.
If Windows still boots normally, here’s how to start in safe mode:
Step 1: Click “Start” → “Settings” → “System” → “Recovery.”
Step 2: Under “Advanced startup,” click “Restart now.”
Use the Windows 11 system settings to run an advanced startup so you can boot into safe mode.
Step 3: After the restart, click “Troubleshoot” → “Advanced options” → “Startup Settings.”
From the options, choose “Troubleshoot,” then “Advanced options,” and finally “Startup Settings.”
Step 4: Restart your system one more time.
Step 5: In the menu that appears, press the “4” key to start Safe Mode.
In the startup settings, press “4” to boot into Safe Mode.
If Windows won’t start normally anymore, you can still reach the Windows Recovery Environment (WinRE) by forcing your PC to shut down three times in a row during startup (hold down the power button).
Windows detects this and automatically opens the troubleshooting options. From there, just follow the steps above.
Run a System Scan in Safe Mode
Once your system starts in Safe Mode, run a full system scan. For the first scan, we use the built-in Windows virus and threat protection.
In Windows 11, you’ll find it under “Settings” → “Privacy & security” → “Windows Security.”
Under “Virus & threat protection,” choose the full system scan instead of the quick scan.
We run the first malware scan with the built-in virus and threat protection.
Once the scan finishes, use a different malware engine for good measure, since one scanner alone rarely catches every threat. Suitable options include Malwarebytes, Norton, or Bitdefender. Many offer a free version.
Download a suitable tool on a separate, uninfected PC and transfer it with a USB stick.
System scan with Malwarebytes
If the tool finds harmful malware, it moves the threat to quarantine and deletes it. Then start your PC as usual and check whether the system behaves normally.
Delete Suspicious Programs and Extensions
After the malware scan, check your system manually, too. Look through your installed apps and programs for suspicious names like “Browser,” “Tool,” or “Updater.” If you don’t recognize a program, research it before removing it.
Also remove any unknown extensions and add-ons in your browser, since malicious programs like to hide there too.
Then exit safe mode by restarting your device.
To finish, open the Task Manager (press Ctrl + Shift + Esc or right-click the taskbar) and check whether any suspicious programs or processes are running in the background without your knowledge.
If nothing looks off here either, you’ve successfully removed the trojan from your system!
Optional for Advanced Users: Bootable Rescue System
If a trojan blocks your anti-malware program and Windows won’t start normally, not even in safe mode, you can launch the malware scanner directly from a bootable USB stick. This method is intended for advanced users and is only needed in rare cases.
For this, you’ll need a USB stick with at least 2 GB of storage and a second, clean PC to create the stick.
Here’s how to do it:
Step 1: Download a free security tool as an .ISO file. For our test, we’re using the Avira Rescue System.
Step 2: Download Rufus, a free tool for creating bootable USB drives.
Step 3: Open Rufus, select the .ISO file you downloaded, choose your USB stick as the target drive, and click “Start.” The process takes a few minutes.
In Rufus, select the .ISO file and choose your USB stick as the drive. Then click “Start” to create the boot stick.
Step 4: Plug the USB stick into the infected device and restart it. To boot from the stick, you’ll need to press a specific key during startup. The key varies by manufacturer, but it’s usually F11 or F12.
In the boot menu, select the USB stick to launch the malware program.
Last Resort: Reinstall Windows
If your system still isn’t running clean after the scan, the safest option is to reinstall the operating system completely. This removes all installed programs (and, depending on your choice, all personal files too), but it also wipes out every last trace of the trojan.
Windows 11 gives you two ways to reset the system:
Option: reset through the settings
Click on “Start” → “Settings” → “System” → “Recovery,” then select “Reset PC.”
You get two options: “Keep my files,” which removes apps and settings but keeps your personal data, or “Remove everything,” which wipes the drive completely.
When you reset your PC through recovery, you can select which data to keep.
The second option is more thorough and the better choice when a trojan has already embedded itself deep in your system. If you pick it, back up your personal data to an external drive first!
Option: reinstall with a USB stick or DVD
Just like with the rescue method, we’ll create a bootable USB stick or DVD. This time though, it will hold a Windows installation.
- 1.
Download the official Microsoft Media Creation Tool. The tool walks you through creating recovery media (a DVD or USB stick) for Windows 11 step by step.
- 2.
Restart your PC and press F11 or F12 during startup (the key depends on your manufacturer) to open the boot menu. Select the external media and start the Windows installation.
Removing a Trojan on Android
Android devices aren’t safe from trojans either. If your phone or tablet is infected, first turn off Wi-Fi and mobile data to stop any further data transfers.
Next, restart the device in safe mode. On most phones, hold down the power button, then press “Power off.”
Alternatively, turn the device off, then hold down the volume-down button as it powers back on, right when the “Powered by Android” logo appears.
Starting an Android device in safe mode.
While in safe mode, go to “Settings” → “Apps” and delete any apps that look suspicious or that you installed right before the problems started. These often have generic names like “Browser,” “Tool,” “Optimizer,” or “Updater.”
After that, restart your device normally to leave safe mode. Then run a full scan with a security tool to confirm the system is clean.
If the device still acts up, a full factory reset is your safest bet. Go to “Settings” → “General management” → “Reset.” Just be sure to back up your personal data first!
How to Prevent Trojan Infections
Once the trojan is gone, change all your important passwords and fully update your system.
To keep your system from getting infected again, follow a few basic security habits. No protection is perfect, but these steps make life much harder for trojans (and other threats):
Final Thoughts: How to Remove a Trojan From Your Device
If a trojan infection hits your system, you don’t always have to reinstall everything. With the correct approach (disconnect from the internet, boot into safe mode, and run a thorough scan with two independent tools), you can remove the malware completely. A full reinstall is only necessary if the trojan has embedded itself too deeply into your system.
With any kind of infection, prevention is your best defense: keep your system up-to-date, use a good virus scanner, and stay alert to phishing attacks.
Frequently Asked Questions
In most cases, yes. If you follow the steps in our guide, you usually won’t need to reinstall the entire operating system to clean it.
The virus and threat protection built into Windows 11 is a solid, free defense against trojans, viruses, and ransomware. Still, if you suspect a trojan, it’s a good idea to run a second malware scanner.
Not automatically, just because your phone is on the same Wi-Fi. But it can spread if you transfer infected files from your PC to your phone or use the same cloud account on both devices. When in doubt, scan your smartphone with a security app too.
No, a reinstall is a last resort, not the norm. Most trojans can be fully removed with a good virus scanner in safe mode. A reinstall only becomes necessary when the trojan has become so deeply embedded in the system that scanners can’t fully clear it out.
