Backdoor.Win.DARKCHEESE: what it is and how to remove it
Backdoor.Win.DARKCHEESE is the threat that can launch malicious processes and run on systems' resources. Stealthy infiltration allows the intruder to operate unnoticed and for a long period of time.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
A second opinion helps when Backdoor:MSIL/AsyncRAT. keeps returning: a free scan checks startup items, tasks and programs together.
Do it yourself · free Remove Backdoor.Win.DARKCHEESE yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Backdoor.Win.DARKCHEESE: summary
| Distribution | Trojans can use various malicious files[2] and sites with malware scripts that trigger infiltration of the malicious programs. You might not notice such infiltration at all |
|---|---|
| Name | Backdoor.Win.DARKCHEESE |
| Type | Trojan/ Possibly false detection |
| Issues | The infection can trigger other issues with the system and affect the performance when many processes are running in the background. The slowness of the device and other issues with crashes or program interruption should raise questions for you and frustrate |
| Detection names | No Microsoft detection name is known |
| Damage | Not recorded in the old report |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 5 more facts
| Symptoms | A Windows Security "Threats found" notification |
|---|---|
| Evidence | 4 write-ups by security sites; details still limited |
| First seen | 14 October 2020 |
| Microsoft Defender name | Backdoor:MSIL/AsyncRAT. |
| Facts checked | 6 October 2026 |
What Backdoor.Win.DARKCHEESE does on an infected PC
From our report of Oct 2020 · not reviewed since
Backdoor.Win.DARKCHEESE is the detection of a threat that possibly falls in the category of backdoor trojans
Backdoor.Win.DARKCHEESE is the threat that can launch malicious processes and run on systems' resources.
Stealthy infiltration allows the intruder to operate unnoticed and for a long period of time. It is possible that the trojan can be active for long until users can spot any issues with the system. This detection can indicate the infection and specifically a backdoor like other threats of this type as Backdoor.SDBot or Backdoor:MSIL/AsyncRAT.
When the infection of this Backdoor.Win.DARKCHEESE virus runs for a while, it can trigger many changes and affect functions of the device significantly when files or programs get corrupted. Since this is the silent threat there are no programs that could be removed to fight the trojan in particular.
This virus can renew itself and steal your data, infect the machine with ransomware, other threats behind your back. It might disguise as another file or a program, so you cannot raise any questions about the malicious file yourself. We cannot fully determine what this detection indicates, but it is not a "good hacking" tool.
Backdoor.Win.DARKCHEESE is a serious threat that can damage the machine when it runs in the background and changes settings, processes, files, and program performance. Trojans can launch various processes so it invades the computer. The device might turn into a bot.
Backdoor.Win.DARKCHEESE can directly act as a vector for threats or provide direct access to your files for a hacker. Trojans and other more advanced malware can be capable of:
If the threat manages to infiltrate the machine and provide access to your files for a hacker that controls the distribution and behavior of Backdoor.Win.DARKCHEESE virus, you might be in danger. Such spying on the person can trigger serious privacy and even identity theft issues.
There are many reasons why you should remove Backdoor.Win.DARKCHEESE, but experts note that trojans, worms, malware, other threats that can spread using misleading and deceptive techniques are extremely persistent and intrusive. You cannot control nor know here the virus gets access to.
Make sure to find a good anti-malware tool that manages to detect this threat and can possibly terminate the trojan fully. Backdoor.Win.DARKCHEESE removal process should involve anti-malware tools like or because AV engines that such applications are based on, can find malicious programs and terminate them.
Unfortunately, you cannot be sure that you eliminated the trojan fully unless you double-check properly with an alternate antivirus tool. Make sure to disable the first application to avoid false detections.
The alert with Backdoor.Win.Incompatible AV tools can also trigger DARKCHEESE warnings on the machine. So double-checking is key, as well as virus damage repair. Rely on or a similar system tool that can find or even fix issues for you.
- deleting data;
- downloading files;
- running programs;
- recording keystrokes;
- stealing sensitive files;
- modifying settings;
- running or stopping applications;
- spreading malware in the machine.
From our report of Oct 2020 · not reviewed since
Malware enters the PC when you don't pay enough attention
Precautionary measures could save you from performing such processes as malware termination because there are issues that should be considered.
When you visit sites online, get exposed to malicious sites or pages with malware distributing scripts, you can get direct infection installed on the system without notice.
There can be malicious programs or files added to the email attachment or a pirated program that you download from the internet. This is why it is essential to check senders of those email notifications and avoid visiting any pages that raise any questions about the security or legitimacy. Rely on proper sources, avoid torrents and pirating, try to keep the machine free of malware.
From our report of Oct 2020 · not reviewed since
More from our earlier report on Backdoor.Win.DARKCHEESE
- The proper way to remove Backdoor.Win.DARKCHEESE - running the anti-malware tool on the machine, so all the infections are found and terminated
- The machine can get affected significantly because trojans manage to alter settings and files, functions, programs.
- Damage caused in system folders triggers later issues.
- Run for corrupted the file and another damage repair
How to check the PC for Backdoor.Win.DARKCHEESE
If Windows Security shows Backdoor:MSIL/AsyncRAT., it has found Backdoor.Win.DARKCHEESE or a file that belongs to it.
Write the name down before you click Remove: it is the most useful search term later, and you will need it if you report the incident.
A family name in the label is more informative than a heuristic one. Our page on why one threat has many antivirus names lists the common formats and what each part means.
How to remove Backdoor.Win.DARKCHEESE
How to remove Backdoor.Win.DARKCHEESE and lock the attacker out
Someone may have had remote control of the PC.
Cut the connection first, then remove the trojan and secure your accounts.
Step 1: Remove remote access tools and lock the attacker out
Unplug the network cable or turn off Wi-Fi first, so any remote session drops.
In Settings > Apps > Installed apps (Windows 11) or Apps & features (Windows 10), uninstall remote access programs you did not set up yourself, such as AnyDesk, ScreenConnect, TeamViewer or an unknown "support" tool.
Check Settings > Accounts > Other users (Family & other users in Windows 10) for accounts you did not create. Turn off Remote Desktop under Settings > System unless you use it.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Delete scheduled tasks that bring it back
Open Task Scheduler from the Start menu and click Task Scheduler Library. Select each task you do not recognise and read the Actions tab:
- a task that starts a file in
%AppData%or%Temp% - runs
powershellwith a long encoded line - opens a web address belongs to Backdoor.Win.DARKCHEESE or a similar program
Right-click such a task and choose Delete, and check the subfolders too. Leave tasks from Microsoft, your PC's maker and programs you use. Task Scheduler is the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
- a task that starts a file in
Step 3: Remove it from startup
Whatever Backdoor.Win.DARKCHEESE installed usually starts with Windows. Open Task Manager with Ctrl + Shift + Esc, go to Startup apps in Windows 11 or the Startup tab in Windows 10, and disable what you do not know, starting with entries that have an empty Publisher column.
Open file location on the right-click menu shows the file, which helps you decide and tells you what to delete later. Disabling is safe: if something you need stops working, switch it back on.
Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Scan the PC, then run the offline scan
Open Windows Security > Virus & threat protection > Scan options, run a Full scan and remove everything it finds. Then select Microsoft Defender Antivirus (offline scan) and click Scan now: the PC restarts and scans before Windows loads, which finds files that hide while Windows runs.
Save your work first, because the offline scan takes about 15 minutes. Both scans are built into Windows 11 and Windows 10, and a second scanner from another vendor is a useful extra opinion.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Assume that the passwords saved in this PC's browsers, and the accounts that were open in them, are known to the attacker. From a phone or a clean computer, change the e-mail password first, then banking, shopping, social and gaming accounts.
Use each service's option to sign out of all other sessions, because stolen cookies keep a session open even after a password change. Turn on two-step verification on each account. Wait with the infected Windows 11 or Windows 10 PC until the scans are clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Oct 2020 · not reviewed since
The best way to get rid of Backdoor.Win.DARKCHEESE virus is to clear the machine fully
You can remove Backdoor.Win.DARKCHEESE yourself, but pop-up alerts, warnings about the particular malware, or suspicious files on the machine are not the ones you need to terminate.
The best way to determine how serious this infection is - running a scan of the system using anti-malware or security tools like or .
You can not only find out what purpose those suspicious files have, but also perform the proper Backdoor.Win.DARKCHEESE removal if needed. These particular malware-fighting tools can indicate any threats that run in the background and clear the infection for you without causing any damage.
[GI=method-1]Reboot the machine in a Safe Mode with Networking before you run the AV tool, so the machine can get cleared properly
[GI=method-2]Remove traces of Backdoor.Win.DARKCHEESE virus with the help of System Restrore
After removal: passwords, accounts and prevention
Secure your accounts after the clean-up
Assume that whatever was saved in the browsers on this PC while the PC showed the Windows Security detection Backdoor:MSIL/AsyncRAT. has been copied:
- passwords
- cookies
- autofill data
Work from a clean device, or from this PC once the offline scan finds nothing.
Start with your main e-mail account, because it can reset everything else, then banking and payment, then social and gaming accounts. Change each password, sign out of all sessions and turn on two-step verification: Turn on two-step verification / secure a hacked account.
The full order, including crypto wallets and card replacement, is in securing your accounts after malware.
Protect your privacy - employ a VPN
There are several ways how to make your online time more private - you can access an incognito tab.
However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise.
Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers - human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence.
In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. is one of the leading file recovery solutions you can find on the market - it is likely to restore even lost emails or data located on an external device.
Questions about Backdoor.Win.DARKCHEESE
What does the name Backdoor:MSIL/AsyncRAT. tell me?
Microsoft builds names in a fixed order:
- category
- then platform
- then family
- sometimes followed by a variant letter
- a suffix
The category is the most useful part for you. Trojan, Backdoor and PWS mean real malware that can download more, give remote access or steal passwords. PUA means unwanted software.
Ransom means ransomware. Suffixes such as !ml or !MTB mean the detection came from machine learning or behaviour analysis. Search for the family part of Backdoor:MSIL/AsyncRAT. together with the word Microsoft to find its entry in Microsoft's security encyclopedia.
Can I ignore Backdoor:MSIL/AsyncRAT. if the PC works fine?
No. Many threats are built to leave the PC working normally while they steal passwords, use the processor or wait for instructions. A detection is Defender telling you it saw something malicious, and the absence of symptoms says nothing about its activity.
Check the action in Protection history: if it is anything other than Quarantined or Removed, remove it now. Then run a full scan. If the detection was a single file caught on download and does not return, you can move on; if Backdoor:MSIL/AsyncRAT. reappears, follow the removal steps in this guide.
Will Windows Security detect Backdoor.Win.DARKCHEESE?
Yes, current Microsoft Defender definitions name it Backdoor:MSIL/AsyncRAT.. Make sure the definitions are up to date first: open Windows Security > Virus & threat protection > Protection updates and click Check for updates. Then run a full scan and the Microsoft Defender offline scan.
If the detection comes back after you remove it, look for the program, task or extension that brings it back, using the plan above. Detection removes files and startup entries, but it does not reverse changes Backdoor.Win.DARKCHEESE already made, so follow the other steps in this guide as well.
Is Backdoor.Win.DARKCHEESE a known trojan?
Not as a documented family, at least not yet. What is known is the visible sign, the Windows Security detection Backdoor:MSIL/AsyncRAT., which matches a hidden program working for someone else.
New threats are often seen by victims weeks before researchers publish anything about them. Treat Backdoor.Win.DARKCHEESE as you would any trojan:
- remove what starts it
- run an offline scan
- change passwords from another device
If a scan reports a detection name, keep it; it usually reveals the family and whether it is known to download other malware. We update this guide when an analysis appears.
Is it safe to do online banking after seeing the Windows Security detection Backdoor:MSIL/AsyncRAT.?
Not on that PC until it is clean. A program that produces the Windows Security detection Backdoor:MSIL/AsyncRAT. runs with your rights and could read what you type or what the browser shows. Use a phone or another computer for banking and for changing passwords.
When the offline scan of the affected PC is clean and nothing suspicious starts with Windows any more, you can go back to using it. Check your bank statements for the past weeks either way, and call the bank if anything looks unfamiliar; banks can block cards and reset access quickly.
What are the signs of a trojan infection?
Most trojans try to leave no visible signs, so look for side effects. Common ones:
- Windows Security turned off or unable to update
- new entries in Startup apps or Task Scheduler
- programs in Installed apps you did not install
- browser settings that changed by themselves
- unusual network activity while the PC is idle
- password-reset or login-alert e-mails you did not trigger
None of these proves an infection on its own. Together with an antivirus alert naming Backdoor.Win.DARKCHEESE, they are a strong reason to follow the full plan.
Can a normal remote support program be a backdoor?
Yes. Tools such as AnyDesk, TeamViewer and ScreenConnect are legitimate, but whoever controls the account behind them controls the PC. Scammers install them during fake support calls, and some trojan campaigns install them silently because antivirus programs do not flag a genuine, signed product.
If you find one you did not set up, uninstall it, check Startup apps for related entries and change passwords from another device. If money or accounts were involved, call your bank and report the incident.
Why didn't my antivirus stop Backdoor.Win.DARKCHEESE?
New trojan builds are packed and changed often so that signatures do not match, and some are signed with stolen or bought certificates. Many arrive inside password-protected archives, which scanners cannot open until you extract them.
Some downloads also tell the user to turn off the antivirus "because it gives false alarms", a common line in cracked software instructions. Keep real-time protection on, never disable it for an installer, and run the offline scan whenever you suspect something slipped through.
Can Backdoor.Win.DARKCHEESE spread to other devices on my network?
Most trojans aimed at home users stay on the PC they infected, but an attacker with remote access can look at the network, open shared folders and try passwords on other devices. Loaders sometimes deliver worms or ransomware that do spread.
Disconnect the PC while cleaning, run a full scan on other Windows PCs, change the router's admin password and the Wi-Fi password if they were saved on the infected PC, and update the router's firmware. If other PCs show the same detection, treat them as infected too.
Will Fortect remove Backdoor.Win.DARKCHEESE?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Backdoor.Win.DARKCHEESE, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Threatpost: ThreatList: Ransomware Trojans Picking Up Steam in 2019 (read October 6, 2026)
- Wikipedia: Macro virus (read October 6, 2026)
- Dieviren: Dieviren (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)