Removing a Trojan That Abuses Windows BITS

A Trojan that uses the Windows Background Intelligent Transfer Service (BITS) can hide behind a legitimate Windows component. BITS normally downloads updates and other files quietly in the background, even when a connection is intermittent. Criminals can abuse the same mechanism to fetch payloads, maintain persistence, or delay activity until the computer is idle.

This type of infection may produce few obvious symptoms. You might notice unusual network traffic, repeated BITS activity, new files in temporary folders, browser redirects, security warnings, or a computer that becomes slow after startup. A suspicious BITS job can remain active after the original malware process has closed, allowing the threat to return.

The safest approach is to isolate the device, record suspicious job details, remove the associated files and persistence mechanisms, and scan the system with reputable security software. The steps below apply mainly to Windows 10 and Windows 11 computers commonly used in Australian homes, offices, schools, and small businesses.

What you observe	Possible meaning	Recommended response
An unfamiliar BITS job	A background download or malware persistence	Inspect its name, owner, URL, and destination
A job repeatedly restarts	The Trojan or a scheduled task is recreating it	Check scheduled tasks, services, and startup entries
Downloads from an unknown domain	Payload delivery or command-and-control activity	Disconnect from the internet and preserve details
A legitimate-looking svchost.exe	BITS may be hosting malicious activity indirectly	Verify file locations and run an offline scan

Disconnect and document the infection

Disconnect Wi-Fi or unplug the Ethernet cable before attempting removal. This prevents the Trojan from downloading additional components or sending information to its operator. If the computer is used for online banking, pause access to banking and email accounts until the system has been checked from a clean device.

Take screenshots or write down suspicious filenames, URLs, pop-ups, and detection names. Do not open unknown downloaded files to “test” them. Australian users should also report suspected cybercrime or scams through ReportCyber and review guidance from the Australian Cyber Security Centre (ACSC). If personal information may have been exposed, contact the affected organisation and consider changing passwords from a separate, trusted device.

Inspect suspicious BITS jobs

Open Windows Terminal or Command Prompt as an administrator and run:

bitsadmin /list /allusers /verbose

On modern Windows systems, PowerShell can provide more detail:

Get-BitsTransfer -AllUsers

Look for jobs with unfamiliar names, unusual remote URLs, paths in AppData, Temp, or public folders, and files with recently created timestamps. A legitimate Microsoft update job may still appear, so avoid judging it solely by its name. Examine the download destination, creating account, notification command, and URL where available.

If a job is clearly malicious, note its display name or job ID and remove it with the matching BITS command or PowerShell cmdlet. For example:

Remove-BitsTransfer -BitsJob $job

Use the job object returned by Get-BitsTransfer rather than copying an unrelated identifier. If removal fails, restart in Safe Mode and repeat the inspection. Do not delete every BITS job automatically, because interrupting a genuine Windows or application update can cause software problems.

Remove the Trojan and its persistence

Run a full scan with Microsoft Defender or a trusted, updated anti-malware product after the suspicious transfer has been removed. Microsoft Defender Offline is useful when the Trojan protects itself during normal Windows operation. Safe Mode can also reduce the number of active third-party processes, making it easier to delete a locked malicious file.

Check Task Scheduler for entries that launch executables from unusual folders or run PowerShell, wscript.exe, mshta.exe, or command scripts at logon. Review Services, Startup apps, and the Run registry locations as well. A BITS job is sometimes only the delivery mechanism; the real persistence may be a scheduled task or a newly installed service.

Do not disable BITS permanently as a general fix. Windows Update, Microsoft Store applications, browsers, and other software may depend on it. If the same job returns, record the process or task recreating it and remove that parent component instead of repeatedly clearing BITS.

Check for wider compromise

After cleanup, inspect browser extensions, proxy settings, DNS settings, and recently installed programs. Trojans may add a browser hijacker, steal session cookies, or install remote-access software alongside the BITS downloader. Remove extensions you do not recognise and reset the browser only after saving important bookmarks.

Change passwords for email, cloud storage, social media, and financial services from a clean device. Turn on multifactor authentication where available, and contact your bank immediately if suspicious payments or login alerts appear. This is especially important for households using the same laptop for work, shopping, and services such as myGov.

If the Trojan encrypted files or delivered ransomware, avoid repeatedly restarting the infected computer. Preserve copies of affected files and review a specialist ransomware removal guide for safe recovery considerations. Paying an attacker does not guarantee decryption and may expose victims to further demands.

Prevent another BITS-based attack

Keep Windows, browsers, JavaScript components, and security software updated. Use a standard user account for everyday work, enable Microsoft Defender protections, and leave Windows Firewall active. Back up important documents to a disconnected drive or a reputable cloud service with version history. Test that backups can actually be restored.

Be cautious with invoice attachments, fake parcel messages, cracked software, and urgent account alerts. These lures are common in Australia, where scammers frequently imitate Australia Post, banks, energy providers, and government services. Verify links independently rather than using the contact details in a message, particularly when working from a home NBN connection or a small-business network in Sydney, Melbourne, Brisbane, or Perth.

For further security instructions, malware explanations, and Windows cleanup advice, use these PC malware resources as an educational reference. A clean scan, restored browser settings, updated software, and monitored account activity together provide stronger protection than removing a single suspicious BITS job.