Pterodo/Pteranodon: what it is and how to remove it
Pterodo is a Trojan known in the cybersecurity landscape since at least 2014. The date is significant due to the first Russian attacks against Ukraine and the annexation of Crimea.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
If mshta.exe returns after removal, a full scan can find the entry that brings it back.
Do it yourself · free Remove Pterodo/Pteranodon yourself 6 steps, about 18 minutes, no software needed.
Start the steps
Pterodo/Pteranodon: summary
| Distribution | Malicious spam email attachments, infected files |
|---|---|
| Name | Pterodo/Pteranodon |
| Type | Trojan, backdoor |
| Cybercriminal group | Russian cyber-espionage group Armageddon |
| Operation | Malware establishes a backdoor that can be used to deliver secondary payloads. It is ultimately used to gather sensitive company information from various Ukrainian organizations |
| Detection names | No Microsoft detection name is known |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 6 more facts
| Damage | Not recorded in the old report |
|---|---|
| Symptoms | An unknown process in Task Manager |
| Evidence | 4 write-ups by security sites; details still limited |
| File names | mshta.exe |
| First seen | 22 April 2022 |
| Facts checked | 6 October 2026 |
What Pterodo/Pteranodon does on an infected PC
From our report of Apr 2022 · not reviewed since
Pterodo is politically motivated malware related to cyberattacks against Ukraine
Pterodo is a Trojan known in the cybersecurity landscape since at least 2014.
The date is significant due to the first Russian attacks against Ukraine and the annexation of Crimea. The malware is tied to a Russian cybercriminals group known as Armageddon (also known as Shuckworm or Gamardeon) and is known to attack a number of Ukrainian organizations.
The main goal of Pterodo malware is to open a backdoor on the affected computers or networks. With the help of this functionality, it can inject secondary payloads; its main purpose remains sensitive data theft that can be used against the country in many ways.
From our report of Apr 2022 · not reviewed since
Operation
As explained by Symantec security researchers, the attack on the system begins with an execution of a malicious VBS file, (a backdoor component of Pterodo malware), which is used to download malicious files from a predetermined URL.
Upon entry, the malware creates a scheduled task that can ensure persistence. Later, a malicious HTA file is downloaded and executed via the mshta.exe, which can execute Microsoft HTML Application files and bypass application control solutions.
After establishing the communication means with a remote C&C server, hackers deliver multiple variants of Pterodo malware. It establishes a VNC client - the main vector of the attack - that can be used for various data gathering, including private company documents with descriptions, account passwords, or other sensitive information.
From our report of Apr 2022 · not reviewed since
More from our earlier report on Pterodo/Pteranodon
- Disconnect from the network and perform a full system scan with anti-malware
- After malware removal, Windows crashes, errors, and similar issues can occur due to damaged system files.
- Employ to fix this damage with ease
How Pterodo/Pteranodon got on your PC
From our report of Apr 2022 · not reviewed since
Like any other high-threat malware strain targeting organizations, Pterodo primarily uses targeted phishing emails to begin the infiltration process.
These emails are sent to employees disguised as useful messages from well-known individuals, for example, managers of people who end up opening the email. Email spoofing is an established technique that easily helps the malware breakthrough into various businesses and organizations.
The email attachments are often booby-trapped with macro-laced code, which, once opened, would be executed. Thus, not allowing documents to execute macros would prevent the infiltration of malware. Adequate anti-malware solutions and adequate staff security training can significantly reduce the probability of infections.
Pterodo malware can also be spread using alternative methods, including drive-by downloads, repacked installers, crack tools, insecure RDP connections, and more.
How to check the PC for Pterodo/Pteranodon
- File:
mshta.exe
How to remove Pterodo/Pteranodon
How to remove Pterodo/Pteranodon and lock the attacker out
Someone may have had remote control of the PC.
Cut the connection first, then remove the trojan and secure your accounts.
Step 1: Remove remote access tools and lock the attacker out
Attackers keep access through remote control tools and extra user accounts. Disconnect the PC from the internet, then remove every remote access program you did not install yourself from the installed apps list in Windows 11 or Windows 10.
Look for a user account you do not know and delete it, and switch off Remote Desktop in Settings > System. Reconnect only for the scan.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Check where mshta.exe runs from and stop it
In Task Manager (Ctrl + Shift + Esc) find
mshta.exeon Processes, right-click it and choose Open file location before ending anything.Windows' own files live in
C:\Windows\System32; the same name in%AppData%, %Temp% or C:\Users\Public is an impostor. If the folder is wrong, right-click the process again, choose End task and delete the file.If it starts again within seconds, a task or another process restarts it, so run the scan step in Safe Mode. Task Manager works the same in Windows 11 and Windows 10.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
Step 3: Delete scheduled tasks that bring it back
Programs like Pterodo/Pteranodon add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 5: Scan the PC, then run the offline scan
A scan finds the parts of Pterodo/Pteranodon that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 6: Change passwords from another device and sign out other sessions
Pterodo/Pteranodon can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
From our report of Apr 2022 · not reviewed since
Pterodo removal steps
Anti-malware solutions at the best means of protection against dangerous malware attacks.
However, since the Trojan is known to use living-off-the-land and similar obfuscation techniques so it might be difficult to spot and remove. The first step of malware removal is removing the affected machine from the network. In order to disconnect several computers at the same time, follow these steps:
Once the device is disconnected, you should begin a full system scan with , , or another powerful anti-malware software. In some cases, it is better to perform a scan in Safe Mode to ensure that the virus does not tamper with the elimination process. To access it, proceed with the following steps:
Windows 7 / Vista / XP
Windows 10 / Windows 8
Malware can cause tremendous damage to Windows systems to the point where a full reinstallation could be required. For example, an infection can alter the Windows registry, damage vital bootup, and other sections, delete or corrupt DLL files, etc. Antivirus software can't repair damaged files, and a specialized app should be used instead.
By employing this tool, you would not have to worry about future computer issues, as most of them could be fixed quickly by performing a full system scan at any time. Most importantly, you could avoid the tedious process of Windows reinstallation in case things go very wrong due to one reason or another.
- Type in Control Panel in Windows search and press Enter
- Go to Network and Internet
- Click Network and Sharing Center
- On the left, pick Change adapter settings
- Right-click on your connection (for example, Ethernet), and select Disable
- Confirm with Yes.
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
- Right-click on the Start button and select Settings.
- On the left side of the window, pick Recovery.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Click Restart.
- Press 5 or click 5) Enable Safe Mode with Networking.
- Download
- Click on the ReimageRepair.exe
- If User Account Control (UAC) shows up, select Yes
- Press Install and wait till the program finishes the installation process
- The analysis of your machine will begin immediately
- Once complete, check the results - they will be listed in the Summary
- You can now click on each of the issues and fix them manually
After removal: passwords, accounts and prevention
Secure your accounts after the clean-up
Assume that whatever was saved in the browsers on this PC while the PC showed an unfamiliar process called mshta.exe in Task Manager has been copied:
- passwords
- cookies
- autofill data
Work from a clean device, or from this PC once the offline scan finds nothing.
Start with your main e-mail account, because it can reset everything else, then banking and payment, then social and gaming accounts. Change each password, sign out of all sessions and turn on two-step verification: Turn on two-step verification / secure a hacked account.
The full order, including crypto wallets and card replacement, is in securing your accounts after malware.
Choose a proper web browser and improve your safety with a VPN tool
Online spying has got momentum in recent years and people are getting more and more interested in how to protect their privacy online.
One of the basic means to add a layer of security - choose the most private and secure web browser. Although web browsers can't grant full privacy protection and security, some of them are much better at sandboxing, HTTPS upgrading, active content blocking, tracking blocking, phishing protection, and similar privacy-oriented features.
However, if you want true anonymity, we suggest you employ a powerful VPN - it can encrypt all the traffic that comes and goes out of your computer, preventing tracking completely.
Lost your files? Use data recovery software
While some files located on any computer are replaceable or useless, others can be extremely valuable.
Family photos, work documents, school projects - these are types of files that we don't want to lose. Unfortunately, there are many ways how unexpected data loss can occur:
- power cuts
- Blue Screen of Death errors
- hardware failures
- crypto-malware attack
- even accidental deletion
To ensure that all the files remain intact, you should prepare regular data backups. You can choose cloud-based or physical copies you could restore from later in case of a disaster. If your backups were lost as well or you never bothered to prepare any, can be your only hope to retrieve your invaluable files.
Questions about Pterodo/Pteranodon
Is mshta.exe safe?
It depends on where the file is and who signed it, not on the name. Open Task Manager, go to the Details tab, right-click mshta.exe and choose Open file location. A file inside Program Files or System32 with a valid digital signature from a known company is usually part of a legitimate program.
A file in AppData, Temp or ProgramData with no signature, especially one that restarts itself after you end it, is suspicious. If you cannot tie the process to anything you installed, uninstall recent unfamiliar programs and run a Microsoft Defender Offline scan.
Can I end mshta.exe in Task Manager?
Ending an unknown process is safe in the sense that Windows will warn you before you close anything critical, and a restart brings back whatever Windows needs. Ending mshta.exe will not remove it, though: if a task or startup entry launches it, it returns at the next sign-in.
Use ending the process as a test. If something important stops working, it belonged to a program you use. If nothing changes and it comes back by itself, find and disable its starter, delete the file and scan the PC.
Is mshta.exe a virus?
If it sits outside the Windows and Program Files folders and your antivirus links it to Pterodo/Pteranodon, yes. mshta.exe is the file name used by this trojan. Some trojans borrow the names of real Windows components, so the name alone does not decide it:
- right-click the process in Task Manager
- choose Open file location
- look at the folder and the publisher under Properties > Details
A file in a user folder with no publisher is the trojan. Do not delete it by hand while it runs; use the offline scan in the plan above.
Can I keep using the PC while Pterodo/Pteranodon is on it?
Not for anything that matters. As long as the program behind an unfamiliar process called mshta.exe in Task Manager runs, it can see what you type and what the browser stores, and it may download more malware. Disconnect the PC from the internet while you remove it, and do your banking, e-mail and password changes from another device.
Once the offline scan finds nothing and the sign does not return after a few restarts, normal use is fine. If the scan keeps finding new items, or you cannot remove the startup entry, a reset of Windows is the safer choice.
Do I need to reinstall Windows to get rid of Pterodo/Pteranodon?
Usually not. A thorough clean-up is enough when the offline scan finds nothing afterwards and you do not see an unfamiliar process called mshta.exe in Task Manager again. A reset is the safer choice if an attacker had remote control, if security tools were switched off, or if detections come back after every clean-up.
Windows 11 can reset itself without a USB stick under Settings > System > Recovery > Reset this PC. Copy documents and photos out first and scan the copies. A reset does not change passwords or undo stolen data, so the account steps still apply.
My antivirus was on. How did a trojan get past it?
Antivirus programs see a file only when it is written or run, and criminals test each new build against popular scanners before release. Detection catches up within hours or days, which is often after the first victims ran it.
Archives with passwords, installers that fetch the malware later, and scripts run through PowerShell make the job harder. That is why behaviour such as downloading cracks or pasting commands matters more than any setting. Keep Windows and Defender updated, and turn on Reputation-based protection in App & browser control.
How do I know if my PC has Pterodo/Pteranodon?
Often you do not, which is the point of a trojan. Possible signs are an antivirus alert naming Pterodo/Pteranodon or a generic trojan detection, unknown programs or scheduled tasks, processes with random names in Task Manager, browser extensions you did not add, security settings turned off, slower performance, or account alerts about logins from unknown places.
The reliable check is a full scan followed by Microsoft Defender's offline scan. If you recently ran a crack, a fake installer or a command a website told you to paste, scan even without symptoms.
Should I report Pterodo/Pteranodon?
Report it if you lost money, if accounts were taken over, if you are a business, or if the trojan came through a scam call. A police or national cybercrime report gives you a reference number for your bank and insurer and helps link cases.
You do not need to report a trojan that antivirus blocked before it ran. Before reporting, write down the dates, the detection name, file names and any messages or transactions linked to the attack; screenshots of antivirus alerts are useful evidence. The country list is in the report section above.
I found AnyDesk or ScreenConnect that I did not install. Is that Pterodo/Pteranodon?
Not necessarily Pterodo/Pteranodon, but it is a warning sign. These are legitimate remote support tools, and criminals use them as ready-made backdoors, especially after tech support scams or fake invoice calls.
If you did not install it and no one you trust set it up, uninstall it, change passwords from a clean device and check your bank account. If someone connected to your PC through it, follow the steps for remote access trojans and consider a Windows reset. Installed apps sorted by date shows when it appeared.
Will Fortect remove Pterodo/Pteranodon?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Pterodo/Pteranodon, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Symantec: Shuckworm Continues Cyber-Espionage Attacks Against Ukraine (read October 6, 2026)
- FTC: How to recognize, remove and avoid malware (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 6, 2026)
- Microsoft Learn: How Microsoft names malware (read October 6, 2026)