Step-by-step guide to removing a banking trojan that steals login credentials

Banking trojans are designed to operate quietly while targeting online banking sessions, payment accounts, email logins, and cryptocurrency wallets. They may capture passwords through keylogging, inject fake banking pages into a browser, redirect traffic, or steal authentication cookies.

Fast action matters because removing the malware does not automatically protect credentials that were already exposed. Treat the infected computer and every account used on it as potentially compromised until scans are clean, passwords are changed from a safe device, and active sessions are revoked.

The steps below apply mainly to Windows systems, although similar checks are useful on macOS. If the computer belongs to an organization, disconnect it and contact the administrator before deleting files or changing system settings.

Recognize the warning signs

Common symptoms include unexpected banking alerts, unfamiliar transactions, browser redirects, new extensions, disabled security tools, or pop-ups asking for payment details. A banking Trojan can also cause unusual CPU activity, slow performance, unexplained network connections, or repeated login prompts.

Do not sign in to banking, email, shopping, or password-manager accounts from the suspected computer. If you need to review activity, use a trusted phone or another known-clean computer. Contact your bank immediately about unauthorized transfers, altered payee details, or suspicious login notifications.

Disconnect the affected computer from Wi-Fi and wired networks. This can interrupt command-and-control communication and limit further data theft, although it will not undo credentials already collected.

Prepare a safe cleanup environment

Before cleaning, record the suspicious program names, alerts, file locations, and approximate time the problem began. Avoid opening unknown files or copying executable programs to a backup drive. Personal documents may be backed up, but scan them before moving them to another system.

On Windows, restart into Safe Mode if the malware blocks security software or repeatedly returns during normal startup. Safe Mode loads a limited set of drivers and services, making it easier to identify persistent threats. If Windows cannot start normally, use the recovery environment and select Safe Mode with Networking only when an updated security scanner requires internet access.

Download security tools from their official publishers using a clean device when possible. A trusted second-opinion scanner and Microsoft Defender Offline can reveal threats that hide from a normal desktop scan. Do not rely on cracked antivirus utilities or random “PC cleaner” downloads, which may install additional unwanted software; guidance about potentially unwanted programs can help distinguish these applications from legitimate tools.

Remove the Trojan and its persistence

Run a full scan with an updated antivirus product, then perform an offline scan if available. Allow the security tool to quarantine detected executables, scripts, scheduled tasks, and related registry entries. Restart only when the scanner requests it, and run a second scan after rebooting.

Review installed applications by sorting them by installation date. Remove unfamiliar programs that appeared around the time of the first symptoms, especially remote-access tools, fake browser utilities, and “security” applications you did not install. Avoid deleting a program solely because its name is unfamiliar; check its publisher and location first.

Inspect browser extensions, startup entries, Task Scheduler, and services for suspicious items. Banking malware often uses a scheduled task or a startup command to relaunch itself. Disable an entry only after confirming that it does not belong to Windows, your hardware manufacturer, or a trusted application. If the same malicious file returns after removal, stop manual experimentation and use a reputable rescue disk or professional incident-response service.

Cleanup method	Best use	Important limitation
Full antivirus scan	Detecting common trojans and related files	May miss deeply hidden or newly modified malware
Offline scan	Checking threats before Windows fully loads	Requires a restart and may need recovery access
Safe Mode cleanup	Removing startup items and stubborn applications	Does not guarantee that every persistence method is gone
Operating system reset	Suspected rootkit, repeated reinfection, or serious compromise	Requires backups, updates, and application reinstallation
Professional analysis	Business devices, major financial loss, or uncertain infection scope	Can involve cost and evidence-preservation requirements

Reset the browser and inspect accounts

After the malware is quarantined, remove unfamiliar extensions and reset browser settings. Check the default search provider, homepage, proxy configuration, notification permissions, saved payment cards, and stored passwords. Clear cookies and active sessions, because stolen session tokens can let an attacker bypass a password change.

Update the browser, Windows, drivers, and security software. Unpatched components can provide a second entry point even after the original banking Trojan is gone. If the infection followed a malicious email attachment or fake document, review backdoor cleanup steps as well.

Use a clean device to change the password for your primary email account first, followed by banking, payment, cloud storage, social media, and password-manager accounts. Every password should be unique. Enable multifactor authentication with an authenticator app or hardware key where possible, then sign out all other sessions and remove unknown recovery methods.

Check for financial and identity abuse

Review bank statements, card activity, wire transfers, digital-wallet transactions, and account profile changes. Attackers may alter trusted beneficiaries, contact details, spending limits, or notification rules rather than making an immediate withdrawal.

Notify the bank’s fraud department through an official phone number or verified application. Ask whether transfers can be recalled, cards should be replaced, and online banking access should be temporarily restricted. Preserve emails, security alerts, transaction records, and malware scan reports in case they are needed for an investigation.

If government identity documents, tax information, or password-reset emails were exposed, consider additional identity-protection measures appropriate to your country. A compromised email account deserves special attention because it can be used to reset many other accounts.

Reduce the chance of reinfection

A clean device can become infected again through the same phishing message, unsafe download, or outdated application. Use standard user accounts for daily activity, keep real-time protection enabled, and avoid software distributed through unofficial download portals.

Apply these practical safeguards:

• Verify banking addresses by using a saved bookmark or manually typing the official domain.
• Treat unexpected invoices, delivery notices, and urgent account warnings as suspicious.
• Keep operating system, browser, extensions, and document software automatically updated.
• Use a password manager and multifactor authentication instead of reusing passwords.
• Maintain offline or versioned backups of important files and test that recovery works.

If suspicious activity continues after scans, browser resets, and password changes, assume the installation may still be compromised. Back up essential personal files after scanning, erase the system, reinstall Windows from trusted media, apply updates, and restore only verified data. For a device used for business banking, obtain qualified forensic assistance before wiping it if evidence may be important.

Continue monitoring financial accounts and login notifications for several weeks. Removing the malicious program is only one part of recovery; securing accounts, reporting fraud quickly, and rebuilding trust in the computer complete the process. Start with network isolation and a scan today, then document each cleanup and account-security step as you proceed.