How to remove a process-hollowing Trojan safely

Removing a Trojan that uses process hollowing to evade detection requires a controlled sequence: isolate the PC, confirm the compromise, remove persistence, and repair Windows. The technique hides malicious code inside a trusted process, so a familiar executable name can conceal an active payload.

The steps below focus on Windows 10 and 11 and suit Australian homes and small offices. They are educational checks rather than a substitute for professional incident response on a business network.

How process hollowing hides malware

Process hollowing commonly starts when malware launches a legitimate Windows executable in a suspended state, replaces its memory with malicious code, and resumes it. The resulting process may show a trusted name and publisher, while its actual behaviour comes from the injected payload.

This code injection differs from a simple virus infection. A loader may delete itself, and scheduled tasks, registry Run keys, services, or compromised startup items can restore the Trojan after a reboot, so removing one executable is rarely enough.

Spot warning signs and isolate the PC

Common clues include an unfamiliar high-memory process, browser redirects, altered security settings, disabled Defender, cryptocurrency mining, or unexplained outbound traffic. If the PC is “playing up” and an executable looks “dodgy”, give it a proper scan; a signed Microsoft name alone does not prove the process is clean.

On an Australian NBN connection, disconnect the affected PC by unplugging Ethernet and switching off its Wi-Fi. Do not reset the shared modem unless advised, avoid online banking from that machine, and unplug removable storage until cleanup is complete.

Confirm the compromise with trusted scans

Open Windows Security, start a Microsoft Defender Offline scan, then run a current full scan and an up-to-date second-opinion scan. Offline scanning is useful when the hollowed process blocks normal access or repeatedly restores itself.

Use Process Explorer to inspect suspicious parents, signatures, and network activity, and check Defender Protection History, Autoruns, services, and scheduled tasks. In a Sydney or Melbourne office, preserve logs and ask the local managed service provider before wiping evidence. The Australian Cyber Security Centre can also guide incident reporting.

Remove the payload and persistence

Let the trusted scanner quarantine and delete confirmed payloads, then reboot. Remove the loader and any dropped copies, but do not manually delete legitimate Windows binaries because their memory use looks unusual. A memory-forensics professional may be needed for a persistent hollowing implant.

Create a restore point, then use Autoruns to review scheduled tasks, services, startup folders, and Run keys. Disable or remove verified malicious entries, and use Process Explorer to investigate parent-child mismatches. Clear temporary download folders and unwanted browser extensions, then rescan before restoring network access.

Repair Windows and protect accounts

After removal, install all Windows updates. Open an elevated Terminal or Command Prompt and run DISM /Online /Cleanup-Image /RestoreHealth, followed by sfc /scannow. These commands repair protected system files, but they do not remove malware by themselves.

Treat every password entered on the infected PC as exposed: change it from a clean device, enable multi-factor authentication, and revoke active sessions. If the Trojan also encrypted photos or videos, follow ransomware cleanup guidance before restoring data. Australian businesses should also assess Privacy Act and OAIC notification duties if customer data may have been accessed.

Compare hollowing with ordinary file malware

Visible behaviour is useful, but process location changes the response. Compare the main clues before deciding what to delete or quarantine.

Clue	Process-hollowing Trojan	Ordinary file-based malware
Code location	Replaces memory inside a trusted process	Runs mainly from its own executable
Task Manager	Trusted-looking name with unusual memory or network use	An obvious unfamiliar executable may appear
Persistence	Scheduled tasks, Run keys, services, or startup items	Often a startup folder, shortcut, or installer
Best response	Offline scan, full cleanup, and system repair	Quarantine, delete, rescan, and repair as needed

Many infections show both patterns. If memory replacement is suspected, prioritise offline scanning and memory-aware examination over simply deleting files highlighted by Task Manager.

Secure the device after cleanup

Once the device is clean, restore connectivity gradually and watch for repeated Defender alerts, strange outbound traffic, or newly created tasks. If the incident affected a shared business account, have its administrator review identity and sign-in logs before normal work resumes.

• Turn on automatic updates and patch supported Windows devices promptly.
• Keep Defender Firewall enabled and test Controlled Folder Access where practical.
• Maintain an offline backup plus a tested cloud copy of important files.
• Replace reused passwords, enable multi-factor authentication, and use passkeys where supported.
• Have a managed service provider monitor endpoint alerts and persistence changes.

Broader hardening is covered in the site's Windows security tips. A final scan from a clean device, followed by several days of monitoring, can reveal persistence that survived the first cleanup.