Monoxide RAT: What It Does and How to Remove It - 2

Do it yourself · free Remove Monoxide RAT (remote access trojan for Windows) yourself 5 steps, 15 minutes, no software needed.

Monoxide RAT (remote access trojan for Windows): summary

Facts checked on 25 October 2026 against PCrisk's removal guide (22 October 2026), Microsoft Learn's Defender Offline page and the FTC's advice for hacked accounts. Our own check was a plain read of published pages: the subject is a name, so no request was sent from our server, and we hold no URLhaus report for it.

We ran no sample and infected no PC; the removal steps follow Microsoft's and the FTC's pages and PCrisk's plan, and were not tried on a live infection.

What Monoxide RAT is, and what we know it

Monoxide RAT is not a website and not a virus that spreads by itself. It is a program, a remote access trojan (RAT), that lets another person control a Windows computer from far away. The only detailed public description we found is a removal guide by PCrisk dated 22 October 2026, so this page says clearly what that guide states and what no source has confirmed.

1 What it is PCrisk describes Monoxide RAT as a tool built to give attackers full control over an infected Windows computer. It says the tool is sold or rented to cybercriminals, who use it to spy on victims, steal data, deliver more malware and manipulate the machine remotely.

PCrisk describes Monoxide RAT as a tool built to give attackers full control over an infected Windows computer. It says the tool is sold or rented to cybercriminals, who use it to spy on victims, steal data, deliver more malware and manipulate the machine remotely.

2 What the buyer gets The features PCrisk lists are remote desktop, webcam and audio capture, a file manager, a remote shell, a task manager, a tool that uploads and runs files, system information, a hidden desktop (HVNC), a privacy mode that blanks the victim's screens, and joke tools such as fake blue screens. The sections go through them.

The features PCrisk lists are remote desktop, webcam and audio capture, a file manager, a remote shell, a task manager, a tool that uploads and runs files, system information, a hidden desktop (HVNC), a privacy mode that blanks the victim's screens, and joke tools such as fake blue screens. The sections go through them.

3 What we could not confirm We found no vendor or researcher report on this family: nothing from Microsoft, ESET, Kaspersky or a CERT that analyses it. We do not know who makes it, which version is current, where its control servers are, which file names and folders it uses, or how many PCs are infected. PCrisk's page gives no file paths, registry keys or hashes.

What we could not confirm

We found no vendor or researcher report on this family: nothing from Microsoft, ESET, Kaspersky or a CERT that analyses it. We do not know who makes it, which version is current, where its control servers are, which file names and folders it uses, or how many PCs are infected. PCrisk's page gives no file paths, registry keys or hashes.

4 What we did not do We did not download or run any sample and we infected no PC. Our own check was limited: this subject is a name, not a web address, so there was no site to request and no URLhaus report to read. Everything behaviour comes from the sources listed at the bottom.

We did not download or run any sample and we infected no PC. Our own check was limited: this subject is a name, not a web address, so there was no site to request and no URLhaus report to read. Everything behaviour comes from the sources listed at the bottom.

What Monoxide RAT (remote access trojan for Windows) does on an infected PC

What we checked on 25 October 2026, and what we could not

This subject is a name, not an address. Our server made no request, because the job was not a plain domain name, and the abuse.ch URLhaus data we hold has no entry for it. Our check was therefore a read of published pages, and it clears nothing.

Our check, 25 October 2026

Site request from our server Not made. There is no web address to ask. We cannot tell you where this malware is hosted or whether any download page is online.

URLhaus reports None in our data. That does not mean no one serves the file; it means we hold no report that names it.

Domain registration Not applicable. There is no domain to look up.

What the one detailed description says PCrisk describes a full remote control tool with a hidden desktop, a remote shell and a way to upload and run files. Microsoft's name for it, as listed by PCrisk, is Trojan:Win32/Wacatac.B!ml.

Independent analysis We found none. Two sandbox report pages named Monoxide appeared in a , but we did not open them, and one group of them looks like a different kind of program (see below).

Dangerous if it ran: treat it as full remote control The rating rests on what PCrisk says the tool can do, not on a test of ours. If you only saw the name, you are not infected by that. If a program or file you ran is named Monoxide by a scanner, assume someone could see and use the PC.

What is known, by date

The public record is short. The dates below are the only ones we can support, and none of them says when the malware was written or first used.

22 October 2026 PCrisk publishes a removal guide PCrisk's guide names Monoxide RAT, lists its features and four antivirus detection names, and says the family is sold or rented to criminals. It also includes a Telegram post that advertises the tool, which we do not link to.

PCrisk publishes a removal guide

PCrisk's guide names Monoxide RAT, lists its features and four antivirus detection names, and says the family is sold or rented to criminals. It also includes a Telegram post that advertises the tool, which we do not link to.

25 October 2026 We add this page Our checker flagged the name as a threat we did not cover. We read PCrisk's page, the Microsoft Defender Offline documentation and the FTC's advice for hacked accounts, and searched for other reports. We found no vendor analysis.

Our checker flagged the name as a threat we did not cover. We read PCrisk's page, the Microsoft Defender Offline documentation and the FTC's advice for hacked accounts, and searched for other reports. We found no vendor analysis.

Date not known Sandbox reports named Monoxide A shows public sandbox pages (ANY.RUN and Joe Sandbox) for files called Monoxide x64.exe and Monoxide-GDI.exe. We did not open them, so we do not know their dates or whether they are the same family as the RAT.

Sandbox reports named Monoxide

A shows public sandbox pages (ANY.RUN and Joe Sandbox) for files called Monoxide x64.exe and Monoxide-GDI.exe. We did not open them, so we do not know their dates or whether they are the same family as the RAT.

Our reading: the name is new in public write-ups, a few days old on the date we checked, and the sources are thin. That is a reason to be careful with any page, including this one, that sounds sure who is behind it or how many people are hit.

Two different things called Monoxide

A for the name returns more than one kind of file. Before you decide what is on your PC, know that "Monoxide" is also used for something that looks like a disk-damaging prank program, which is not a remote access trojan.

If a disk-damaging program ran, a PC can fail to start. That is a different problem from remote control, and the first step is the same: do not keep using the PC for banking or work. We do not know of any link between the two, so we do not claim one.

What Monoxide RAT can do, feature by feature

The list below is PCrisk's description of the tool's of abilities. A buyer decides which to use. A list of abilities does not prove that any one PC lost anything.

What Monoxide RAT (remote access trojan for Windows) can steal or download

What a person with this tool can take

PCrisk does not list a built-in password stealer. It lists control tools. With a screen view, a shell and a file manager, a person can still reach almost everything a logged-in user can. The chips below are what the listed features make possible, not what any report says was taken.

Possible with the listed features

Everything shown on your screen

Your webcam and microphone

Documents, photos and downloads

Sessions already logged in

Passwords typed while watched

Banking pages opened on the PC

Crypto wallets that are open

Commands run in PowerShell

Extra malware started on the PC

Your list of installed security software

The hidden desktop deserves a plain word. HVNC (hidden virtual network computing) opens a second desktop in the background. An operator can start a browser there that is already signed in to your accounts, and you see nothing on your own screen. That is why "my bank looked normal" does not clear a PC.

What this can cost you

Reading the tool or seeing its name costs nothing. The risks below apply to a Windows PC where the program really ran. PCrisk names stolen passwords and banking data, identity theft, botnet enrolment, further infections, financial loss and account takeover.

High Accounts and money Anything typed or opened while the operator watched can be used. Changing passwords on the same PC does not help while the tool still runs.

Anything typed or opened while the operator watched can be used. Changing passwords on the same PC does not help while the tool still runs.

High Someone using your PC live A remote tool is not a one time theft. The operator can return whenever the PC is on and online.

Someone using your PC live

A remote tool is not a one time theft. The operator can return whenever the PC is on and online.

High More malware The upload and run feature is a door for other families, including ransomware. What else was started is not visible from this page.

The upload and run feature is a door for other families, including ransomware. What else was started is not visible from this page.

Medium Privacy of your or office The webcam and microphone features mean images and sound can be captured. We do not know whether a given build does so quietly.

Privacy of your or office

The webcam and microphone features mean images and sound can be captured. We do not know whether a given build does so quietly.

Medium Your files The file manager can copy or delete files across drives, so private documents may be exposed or lost.

The file manager can copy or delete files across drives, so private documents may be exposed or lost.

Low Nothing, if you only saw the name A name in a news item, a log or a warning is not an infection.

Nothing, if you only saw the name

A name in a news item, a log or a warning is not an infection.

What you may notice, and what you may not

PCrisk says there are no clearly visible symptoms, because a RAT is built to stay quiet. The rows below mix that statement with signs that follow from the listed features. They are our reading, and most victims notice nothing.

How to check the PC for Monoxide RAT (remote access trojan for Windows)

How a person ends up with a RAT like this

Nobody installs a remote access trojan on purpose. A program has to be run. PCrisk lists the usual routes, and we do not know which one carried Monoxide RAT in any given case.

1 Phishing emails with a file or a link An attachment such as an invoice, a shipping notice or a document that asks you to run something, or a link to a download. PCrisk names malicious attachments and links first.

Phishing emails with a file or a link

An attachment such as an invoice, a shipping notice or a document that asks you to run something, or a link to a download. PCrisk names malicious attachments and links first.

2 Fake software sites and pirated programs A page that imitates a known program, or a crack, a key generator or a cheat tool, can hide the client. PCrisk names fake software sites, pirated software and cracks.

Fake software sites and pirated programs

A page that imitates a known program, or a crack, a key generator or a cheat tool, can hide the client. PCrisk names fake software sites, pirated software and cracks.

3 Malicious ads and social media links An advert or a link in a message that leads to a download. PCrisk names both.

Malicious ads and social media links

An advert or a link in a message that leads to a download. PCrisk names both.

4 Torrents and peer to peer downloads Files from file sharing networks are named by PCrisk as a route. A paid program that comes free is a common wrapper.

Torrents and peer to peer downloads

Files from file sharing networks are named by PCrisk as a route. A paid program that comes free is a common wrapper.

Check your PC before you delete anything

Start with the question that matters: did you run an unknown program, a crack, an installer from an odd site or an attachment you did not expect? If yes, or if you are not sure, do the checks below. None of them deletes anything.

While you check, stop using the PC for banking, email, work or crypto. If you can, disconnect it first, because a remote tool needs a connection to be used.

1 Disconnect first Turn off Wi-Fi or unplug the network cable. PCrisk's own plan starts the same way: cut the connection to stop data theft and remote commands.

Turn off Wi-Fi or unplug the network cable. PCrisk's own plan starts the same way: cut the connection to stop data theft and remote commands.

2 Open Protection history In Windows Security > Virus & threat protection > Scan options > Protection history , look for a detection called Monoxide or Wacatac, or for anything blocked or quarantined around the day you ran the file.

Open Protection history

In Windows Security > Virus & threat protection > Scan options > Protection history , look for a detection called Monoxide or Wacatac, or for anything blocked or quarantined around the day you ran the file.

3 Look at Startup apps Open Settings > Apps > Startup and look for names you did not install. PCrisk says System Info reads startup entries, so entries are a place to look. We found no source that names the entry this family creates.

Open Settings > Apps > Startup and look for names you did not install. PCrisk says System Info reads startup entries, so entries are a place to look. We found no source that names the entry this family creates.

4 Open Task Manager Press Ctrl+Shift+Esc and sort the Processes tab by network or CPU. Look for a program you do not know, or one running from a user folder, Downloads or Temp. A normal name does not clear the PC, and a missing name does not either.

Press Ctrl+Shift+Esc and sort the Processes tab by network or CPU. Look for a program you do not know, or one running from a user folder, Downloads or Temp. A normal name does not clear the PC, and a missing name does not either.

5 Check installed apps Open Settings > Apps > Installed apps and sort by install date. Anything installed on the day you ran the suspect file, and that you do not recognise, is worth writing down before you act.

Open Settings > Apps > Installed apps and sort by install date. Anything installed on the day you ran the suspect file, and that you do not recognise, is worth writing down before you act.

6 Check the hosts file and DNS settings PCrisk's plan includes a look at the hosts file and DNS settings. The hosts file is C:\Windows\System32\drivers\etc\hosts . Lines that are not and point a known site to an odd address are a sign of tampering. PCrisk does not say this family changes it.

Check the hosts file and DNS settings

PCrisk's plan includes a look at the hosts file and DNS settings. The hosts file is C:\Windows\System32\drivers\etc\hosts . Lines that are not and point a known site to an odd address are a sign of tampering. PCrisk does not say this family changes it.

7 Check your accounts from another device Look at the sign in activity of your email, bank and exchange accounts. This is quicker than any file check, and the FTC lists unexpected login attempts and changed details as signs of a hacked account.

Check your accounts from another device

Look at the sign in activity of your email, bank and exchange accounts. This is quicker than any file check, and the FTC lists unexpected login attempts and changed details as signs of a hacked account.

8 A scan helps, but it does not clear the PC A scan can find known files. Treat a clean result like a quiet site test: one data point. Detection names for this family are generic, so a clean scan today does not prove a clean PC.

A scan helps, but it does not clear the PC

A scan can find known files. Treat a clean result like a quiet site test: one data point. Detection names for this family are generic, so a clean scan today does not prove a clean PC.

What to remove by hand

We could not find a published list of this family's files, folders, registry keys or tasks. PCrisk does not give one, and we found no vendor report that does. We will not invent names. Below is what is known and where you look instead.

Note the order. Do the account changes from another device first, run the offline scan, and only then tidy entries by hand. Deleting a file you cannot identify can break Windows or a program you use, and a person with remote access may already have copied what they wanted.

How to remove Monoxide RAT (remote access trojan for Windows)

How to remove Monoxide RAT

A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.

1 Step 1 : Delete scheduled tasks that bring it back Programs like Monoxide RAT add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently. On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete . Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 1 : Delete scheduled tasks that bring it back

Programs like Monoxide RAT add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler , open Task Scheduler Library and sort by Last Run Time to see what ran recently.

On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete .

Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

2 Step 2 : Remove it from startup Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component. Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check. Full procedure with screenshots: Stop apps from opening at startup On uGetFix

Step 2 : Remove it from startup

Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.

Right-click an entry and choose Open file location to see where it runs from: programs in %AppData% or %Temp% deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.

Full procedure with screenshots: Stop apps from opening at startup On uGetFix

3 Step 3 : Delete the folders left behind Uninstalling often leaves the program's folders, and some threats reinstall themselves from them. Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after Monoxide RAT, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too. If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10. Full procedure with screenshots: Remove what malware leaves behind in Windows

Step 3 : Delete the folders left behind

Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.

Press Windows + R , type %LocalAppData% and press Enter, then do the same for %AppData% and %ProgramData%, and look for folders named after Monoxide RAT, its publisher or created on the day the problem started.

Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.

If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.

Full procedure with screenshots: Remove what malware leaves behind in Windows

4 Step 4 : Scan the PC, then run the offline scan A scan finds the parts of Monoxide RAT that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports. Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running. It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean. Full procedure with screenshots: Run a Microsoft Defender Offline scan

Step 4 : Scan the PC, then run the offline scan

A scan finds the parts of Monoxide RAT that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options , start a Full scan and quarantine what it reports.

Follow it with Microsoft Defender Antivirus (offline scan) > Scan now , which restarts the PC and checks the disk while Windows and the malware are not running.

It takes 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.

Full procedure with screenshots: Run a Microsoft Defender Offline scan

5 Step 5 : Change passwords from another device and sign out other sessions Monoxide RAT can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft. Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules. Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean. Full procedure with screenshots: Turn on two-step verification / secure a hacked account

Step 5 : Change passwords from another device and sign out other sessions

Monoxide RAT can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.

Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.

Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.

Full procedure with screenshots: Turn on two-step verification / secure a hacked account

If you use a Mac, an iPhone or an Android phone

PCrisk describes Monoxide RAT as a Windows tool and lists Windows detection names. We found nothing that says it runs on anything else.

After removal: passwords, accounts and prevention

After a clean PC: protect what was exposed

The PC is one half. The other half is everything you opened, typed or stored while the tool could have been running. The order matters: another device first, then the PC.

1 Change passwords from a clean device Start with your main email, because it resets everything else, then bank, work, cloud storage and crypto. Use a long unique password for each. PCrisk also says to change passwords from a clean device and to watch the accounts for seven days.

Change passwords from a clean device

Start with your main email, because it resets everything else, then bank, work, cloud storage and crypto. Use a long unique password for each. PCrisk also says to change passwords from a clean device and to watch the accounts for seven days.

2 Sign out other sessions and turn on two step sign in The FTC says to sign out of the account on all devices and to turn on two factor authentication if it is offered. Update the recovery email and phone, and look for forwarding rules you did not create in your mail.

Sign out other sessions and turn on two step sign in

The FTC says to sign out of the account on all devices and to turn on two factor authentication if it is offered. Update the recovery email and phone, and look for forwarding rules you did not create in your mail.

3 Move crypto first if a wallet was on the PC If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet on a clean device and move the funds.

Move crypto first if a wallet was on the PC

If a seed phrase or wallet file was ever on the PC, assume it is known. Create a new wallet on a clean device and move the funds.

4 Run Microsoft Defender Offline Microsoft says to open Windows Security > Virus & threat protection > Scan options , choose Microsoft Defender Offline scan and select Scan now . Save your work first: Windows signs you out and restarts, and the scan takes 15 minutes. If BitLocker is on, suspend it first or the restart may ask for the recovery key. Results appear under Protection history . Microsoft says the scan needs the Windows Recovery Environment enabled, and gives reagentc /info to check it.

Run Microsoft Defender Offline

Microsoft says to open Windows Security > Virus & threat protection > Scan options , choose Microsoft Defender Offline scan and select Scan now . Save your work first: Windows signs you out and restarts, and the scan takes 15 minutes. If BitLocker is on, suspend it first or the restart may ask for the recovery key. Results appear under Protection history . Microsoft says the scan needs the Windows Recovery Environment enabled, and gives reagentc /info to check it.

5 Remove leftovers with care PCrisk's plan adds a look at startup entries and files with tools such as Autoruns and Process Explorer, and a reset of browsers and notification permissions. Delete only what you can tie to the malware. If you cannot tell, do not guess: the reset below is the safer answer.

Remove leftovers with care

PCrisk's plan adds a look at startup entries and files with tools such as Autoruns and Process Explorer, and a reset of browsers and notification permissions. Delete only what you can tie to the malware. If you cannot tell, do not guess: the reset below is the safer answer.

6 If you are not sure, reset Windows At Settings > System > Recovery > Reset this PC , Remove everything wipes the PC. For a PC that may have been under remote control, a full wipe is the answer that does not depend on finding every piece. PCrisk also says a clean Windows reinstall is worth considering if the malware returns or credential theft malware ran with admin rights.

If you are not sure, reset Windows

At Settings > System > Recovery > Reset this PC , Remove everything wipes the PC. For a PC that may have been under remote control, a full wipe is the answer that does not depend on finding every piece. PCrisk also says a clean Windows reinstall is worth considering if the malware returns or credential theft malware ran with admin rights.

7 Restore only documents by hand Copy back documents and photos, not programs, and not a full system image made after the first . Install apps from their makers' own sites.

Restore only documents by hand

Copy back documents and photos, not programs, and not a full system image made after the first . Install apps from their makers' own sites.

8 Watch your money and your accounts Check card statements and exchange logs for a few weeks and turn on alerts. The FTC says to report stolen personal information at IdentityTheft.gov, which gives a recovery plan.

Watch your money and your accounts

Check card statements and exchange logs for a few weeks and turn on alerts. The FTC says to report stolen personal information at IdentityTheft.gov, which gives a recovery plan.

9 Tell the people you message If your accounts were used to send links, tell your contacts not to open them.

Tell the people you message

If your accounts were used to send links, tell your contacts not to open them.

Keep a PC out of this kind of chain

Every route PCrisk names starts with a person running a file. That is where you can stop it.

Treat an unexpected attachment or a link asking you to download something as an attack, and close it.

Keep Windows and Microsoft Defender updated; the offline scan uses the latest definitions.

Show file endings in File Explorer so a program posing as a document is visible.

Get programs from their makers' own sites or from the Microsoft Store.

Use a password manager and two step sign in, so one stolen password is not enough.

Keep a backup of documents on a disk that you unplug.

Do not run cracks, key generators or cheat tools from sites that promise free versions of paid software.

Do not download from torrent or file sharing sites for programs you could buy.

Do not click ads that offer a download, even for a known program name.

Do not change your passwords on the PC you suspect.

Do not rely on a quiet scan to say that you are safe.

Questions Monoxide RAT (remote access trojan for Windows)

What is Monoxide RAT?

Monoxide RAT is a remote access trojan for Windows. PCrisk, in a guide dated 22 October 2026, describes it as sold or rented to criminals and built to give them full control of an infected computer:

We found no vendor analysis, so who makes it and how widely it spreads is not known. We did not run a sample ourselves.

Is Monoxide RAT a virus?

Not in the strict sense. A virus copies itself to other files or computers. Monoxide RAT is described as a trojan: a program a person has to run, often disguised as something else.

It does not spread by itself according to PCrisk. It arrives by phishing emails, fake software sites, cracks, malicious ads, social media links or torrents, and then gives an operator remote control of that one PC.

Is Monoxide RAT dangerous?

Yes, if it ran on your PC. A remote tool lets a stranger watch the screen, use the webcam, copy files, run commands and start more malware, and the hidden desktop lets them use logged in accounts unseen.

If you only read the name, nothing has happened. Treat a PC that ran an unknown program or crack as watched until you have changed passwords from another device and cleaned or reset Windows.

How do I know if Monoxide RAT is on my PC?

You may not. PCrisk says there are no clear symptoms. Check Windows Security Protection history for a detection, Settings Apps Startup and Task Manager for programs you do not know, and your accounts for logins you did not make.

A black screen, a fake update window or a webcam light that comes on alone are possible signs. A clean result does not clear the PC, because detection names for this family are generic.

How do I remove Monoxide RAT from Windows?

Disconnect the PC, then change your passwords from another device, starting with email. Run a Microsoft Defender Offline scan (Windows Security, Virus and threat protection, Scan options), check startup entries and the hosts file, and delete only what you can tie to the malware.

If you are not sure, reset Windows with Remove everything and restore documents only. We followed Microsoft and PCrisk; the steps were not tested on an infected PC.

What does antivirus call Monoxide RAT?

PCrisk lists four names:

Microsoft Trojan:Win32/Wacatac.B!ml

ESET-NOD32 Win64/Spy.Agent_AGen.FY

Kaspersky UDS:Trojan.Win32.Generic

Avast MalwareX-gen [Misc]

They are generic labels rather than a family name, so a clean scan or a different name does not rule it out. Check Protection history in Windows Security to see what Defender found, and note the date and the file name it shows.

If your product shows a different name for the same file, that is normal, because each vendor labels samples in its own way.

Is the Monoxide GDI program the same as Monoxide RAT?

We do not know. results show sandbox pages for files named Monoxide-GDI.exe and Monoxide x64.exe, and a fan wiki ties them to screen effects and possible damage to the disk's boot area.

That looks like a different kind of program from a remote access tool. We did not open those pages and found no source that links the two, so we do not claim one.

Does Monoxide RAT affect Mac, iPhone or Android?

We found nothing that says so. PCrisk describes it as a Windows tool and lists Windows detection names only. On a Mac, iPhone or Android phone there is nothing to remove for this threat.

If you typed a password on a suspicious page or used a PC that may have been infected, change that password from a device you trust.

Will resetting Windows remove it, and are my accounts safe afterwards?

A reset with Remove everything wipes programs and startup entries, which does not depend on finding every piece. It does not undo what was already taken.

Passwords, logged in sessions and crypto seed phrases that the operator could see stay exposed until you change them from another device and turn on two step sign in. Restore documents by hand, not a full system image.

Will Fortect remove Monoxide RAT?

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For Monoxide RAT, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.

PCrisk: Monoxide RAT, malware removal instructions (22 October 2026) ( read October 25, 2026 )

Microsoft Learn: Microsoft Defender Offline scan in Windows (updated 25 August 2026) ( read October 25, 2026 )

FTC: Email or social media hacked? Here's what to do ( read October 25, 2026 )

ANY.RUN: public sandbox report for Monoxide x64.exe (seen in a listing on this date; the page itself was not opened, used only to say that such files exist) ( read October 25, 2026 )

Joe Sandbox: automated analysis report for Monoxide-GDI.exe (seen in a listing on this date; the page itself was not opened, used only to say that such files exist) ( read October 25, 2026 )