NetSupport Manager: what it is and how to remove it

NetSupport Manager is a legitimate remote management tool developed by NetSupport Limited designed for IT administrators to access and control client computers remotely.

However, cybercriminals misuse this commercial application as a Remote Access Trojan (RAT) to gain unauthorized control over victims' machines. When deployed maliciously, it allows attackers to install additional malware, steal banking credentials, access webcams, capture screenshots, and monitor user activity without permission.

The malicious versions are typically spread through deceptive fake updates disguised as Flash Player, Chrome, or Firefox installations. According to FireEye researchers, this abuse primarily affects users in the USA, Netherlands, and Germany, though other countries are targeted as well.

The infection begins when users visit compromised websites that redirect them to fake update prompts for popular software like Chrome. If users click the update button, a JavaScript file hosted on Dropbox is executed, which transmits system information to attackers' servers.

The initial malicious script uses obfuscation techniques to avoid detection by security software. The remote server responds by sending another file called Update.js, which downloads the actual NetSupport Manager payload. The malware uses PowerShell commands to retrieve a password-protected 7zip archive containing the final payload, then establishes remote access capabilities on the infected system.

Beyond establishing remote access, NetSupport Manager modifies the Windows registry, disables Windows Error Reporting, adds firewall exceptions to hide its presence, and conceals files on the system. System files become infected, potentially causing malfunctions even after removal. The malware can download additional malicious software, harvest sensitive information, and create backdoors for future attacks.

Some versions prevent users from terminating the process due to interference with security software. Victims may experience unexplained system behavior changes, inability to run security tools, and compromised passwords or financial accounts if attackers gain access to banking platforms through remote sessions.

NetSupport Manager itself is legitimate software developed by NetSupport Limited for authorized remote administration purposes. The application becomes malicious only when deployed without user consent by cybercriminals. The tool's remote control capabilities that are beneficial for IT support become dangerous when abused by attackers.

Many antivirus programs detect malicious variants as threats because of the unauthorized installation and misuse context, not because the software itself is inherently malicious. Users should only encounter legitimate NetSupport Manager if their IT department intentionally installs it on their machine as part of authorized system administration.

Signs of NetSupport Manager infection include unexpected firewall changes, disabled Windows Error Reporting, modified registry entries, unexplained background processes, and inability to run security software effectively. You may notice your computer behaving strangely, security tools being blocked from operation, or inability to access certain system settings.

The HoeflerText font warning pop-ups are often associated with the infection vector, though the font issue and malware are separate problems. System performance may degrade due to background remote access activity. If you suspect infection, do not attempt to remove it manually since system files may be corrupted; use professional anti-malware tools instead.

No, never contact cybercriminals or engage with them in any way. Attackers have no incentive to help you or limit the damage they cause. Contacting them only confirms your email is active and may lead to additional targeting, extortion attempts, or identity theft.

There is no legitimate reason to communicate with malware operators, and such communication could be used as evidence against you in legal proceedings. Instead, focus entirely on removal using proper security software and recovery procedures. Report the infection to relevant authorities and notify anyone whose information may have been compromised through your system.

Boot your computer into Safe Mode with Networking to prevent the malware from interfering with removal attempts. Download and run reputable anti-malware software from a clean device if possible, then perform a full system scan.

Professional security tools are essential because manual removal is extremely risky; system files infected by the malware cannot be safely identified and deleted by untrained users.

After removal, use a system optimization tool to repair any registry changes and corrupted files left behind. Change all passwords from a different device, monitor financial accounts closely, and consider credit monitoring services if banking information was accessed.

Never download software updates through browser pop-ups or notifications from websites. Always initiate updates directly from official software websites or through built-in update mechanisms. Keep your operating system and all software fully patched to prevent exploitation.

Use reputable security software and keep it updated with the latest threat definitions. Avoid clicking links or downloading attachments from untrusted emails, and be suspicious of urgent-sounding messages requesting immediate action.

Use advanced or custom installation settings when installing new programs to prevent bundled PUPs. Practice caution when browsing untrusted websites, and consider using ad-blocking software to prevent malicious advertisements.

After confirming NetSupport Manager removal with a successful security scan, immediately change passwords for all accounts from a clean device, paying special attention to email, banking, and financial services. Monitor your credit reports and consider placing a fraud alert with credit bureaus if financial information was exposed.

Review financial accounts for unauthorized transactions and contact your bank if any suspicious activity appears. Reset your browser settings to defaults and remove any unfamiliar extensions or toolbars. Run additional full system scans to ensure complete removal, and consider consulting with a cybersecurity professional if the infection was particularly severe or if data access is suspected.

Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.

For NetSupport Manager, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.

Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.