RadMin: what it is and how to remove it
Radmin is a Remote Access Trojan allowing hackers to control your computer remotely. The 2018 guide noted this malware deletes its executable making detection and removal complicated.
Facts checked October 5, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Unsure whether admdll.dll is safe? A free scan checks the file and what starts it.
Do it yourself · free Remove RadMin yourself 6 steps, about 18 minutes, no software needed.
Start the steps
RadMin: summary
| Detection names | No Microsoft detection name is known |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Name | RadMin |
| Type | Loader |
| Symptoms | An unknown process in Task Manager |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 4 more facts
| Evidence | 4 write-ups by security sites; details still limited |
|---|---|
| File names | admdll.dll and C:\Windows\System32\config\admdll.dll |
| First seen | 11 July 2018 |
| Facts checked | 5 October 2026 |
What RadMin does on an infected PC
From our report of Jul 2018 · not reviewed since
Malware can strike unexpectedly, so be ready
Trojan horses are the sneaky type of infections which also opens doors to other malware, such as ransomware or digital currency miners.
These cyber threats are perilous as they can lead to file destruction or hardware wear and tear over time. Of course, there is no way to protect yourself from malware 100%, but there is something you can do to decrease the possibility of infection.
Security experts note that the most effective trojan horse distribution method is via malicious spam email attachments. With the help of bots, hackers send out thousands of emails to various users. These phishing emails may look dodgy, or closely resemble/look identical to messages one would get from the legitimate company, like Amazon or FedEx.
Therefore, it is essential to recognize these threats. Never open attachments within these emails, especially if they ask for the macro function to be enabled. Additionally, pay attention to hyperlinks that are fake - merely place a cursor on it and you will see the address it will lead you to. Finally, check the "From" address - it is the biggest giveaway that it is a scam.
From our report of Jul 2018 · not reviewed since
More from our earlier report on RadMin
- Rarely any, although users may notice occasional freezes or/and crashes
- Stolen personal information and malware infiltration
What RadMin can steal or download
From our report of Jul 2018 · not reviewed since
Radmin virus is a remote administration tool (RAT) that comes into systems as a trojan horse via spam emails or malicious websites.
The malware gains root access to the computer and allows hackers to remotely control it, like making screenshots or installing another malware. Unfortunately, the main executable deletes itself as soon as the malicious payload is executed, making detection and removal much more complicated.
Initially, this software is an official tool used by IT specialists as administration software. However, the remote access component can be abused by hackers to control victims' computers, which gets injected via a trojan. We are going to talk about the malicious version of the program, namely, Radmin virus or Win32.RAdmin.Zenworks.
Remote administration tools are hazardous when abused by cybercriminals, because users may completely lose the control of their machine. As soon as the malware is injected into the PC, it creates the following files:
System services, used by Windows OS are replaced by malicious executable which runs in the Task Manager. Malware also modifies other settings in order to gain persistence. There is no doubt that users should immediately remove Radmin trojan from their computers, and it should not be done manually, as trojan horses are viruses that are written in a sophisticated code. Therefore, we suggest using security software, such as .
The RAT tool allows hackers to perform various malicious tasks on the targeted computer, including:
Although some files might be deleted or software corrupted, it is not the main danger of Radmin trojan. Information tracking can lead to severe consequences, such as identity theft or stolen money directly from your bank account.
Unfortunately, the malware rarely exposes any symptoms, as its goal is to remain undetected while the malicious activity is taking place. However, users may experience occasion system or software crashes or freezes, increased CPU usage, an increased amount of advertisement on their browsers, and an overall sluggish PC performance.
Therefore, we advise you take care of Radmin removal. For that, you will have to scan your machine with reputable security software.
- C:\Windows\System32\config\admdll.dll
- C:\Windows\System32\config\raddrv.dll
- C:\Windows\System32\config\svchost.exe
- C:\Windows\System32\config\svcset.bat
- C:\Windows\System32\config\svcset.reg
- C:\:services.exe
- Multiply itself via the network;
- Download and upload malicious files;
- Change various system parameters;
- Start or shut down applications;
- Record victim's activity.


How to check the PC for RadMin
- Path:
C:\Windows\System32\config\admdll.dll - File:
admdll.dll
How to remove RadMin
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Check where admdll.dll runs from and stop it
In Task Manager (Ctrl + Shift + Esc) find
admdll.dllon Processes, right-click it and choose Open file location before ending anything.Windows' own files live in
C:\Windows\System32; the same name in%AppData%, %Temp% or C:\Users\Public is an impostor. If the folder is wrong, right-click the process again, choose End task and delete the file.If it starts again within seconds, a task or another process restarts it, so run the scan step in Safe Mode. Task Manager works the same in Windows 11 and Windows 10.
Full procedure with screenshots: Close a frozen app (Task Manager, Force Quit) On uGetFix
Step 2: Delete scheduled tasks that bring it back
Programs like RadMin add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.

Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after RadMin, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 5: Scan the PC, then run the offline scan
A scan finds the parts of RadMin that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.

Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 6: Change passwords from another device and sign out other sessions
RadMin can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.

Windows 10 / Windows 8
- Right-click on Start button and select Settings.

- Scroll down to pick Update & Security.

- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.

- Select Troubleshoot.
- Go to Advanced options.

- Select Startup Settings.

- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.

Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.

- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.

- Go back to the process, right-click and pick End Task.

- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.

Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.

- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.

- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Jul 2018 · not reviewed since
If your computer is infected with RadMin virus, proceed with the following elimination steps
To remove Radmin virus, you will have to download and install security software, if you do not possess one yet.
Beware that the trojan deletes its executable and can make detection much more complicated. To ensure complete Radmin removal, we suggest you enter Safe Mode with Networking on your device, as explained below.
[GI=method-1]In case security software cannot start properly, enter Safe Mode with Networking:
[GI=method-2]You can also eliminate Radmin by using System Restore:
After removal: passwords, accounts and prevention
Secure your accounts after the clean-up
Assume that whatever was saved in the browsers on this PC while the PC showed an unfamiliar process called admdll.dll in Task Manager has been copied:
- passwords
- cookies
- autofill data
Work from a clean device, or from this PC once the offline scan finds nothing.
Start with your main e-mail account, because it can reset everything else, then banking and payment, then social and gaming accounts. Change each password, sign out of all sessions and turn on two-step verification: Turn on two-step verification / secure a hacked account.
The full order, including crypto wallets and card replacement, is in securing your accounts after malware.
Access your website securely from any location
When you work on the domain, site, blog, or different project that requires constant management, content creation, or coding, you may need to connect to the server and content management service more often. The best solution for creating a tighter network could be a dedicated/fixed IP address.
If you make your IP address static and set to your device, you can connect to the CMS from any location and do not create any additional issues for the server or network manager that needs to monitor connections and activities. VPN software providers like can help you with such settings and offer the option to control the online reputation and manage projects easily from any part of the world.
Recover files after data-affecting malware attacks
While much of the data can be accidentally deleted due to various reasons, malware is one of the main culprits that can cause loss of pictures, documents, videos, and other important files.
More serious malware infections lead to significant data loss when your documents, system files, and images get encrypted. In particular, ransomware is is a type of malware that focuses on such functions, so your files become useless without an ability to access them.
Even though there is little to no possibility to recover after file-locking threats, some applications have features for data recovery in the system. In some cases, can also help to recover at least some portion of your data after data-locking virus infection or general cyber infection.
Questions about RadMin
What is Radmin virus?
It is a remote administration tool that functions as a Trojan horse, allowing hackers to remotely control your device. Radmin virus comes into systems via spam emails or malicious websites. The malware gains root access to your computer and allows hackers to perform various malicious tasks.
The main executable deletes itself after the malicious payload is executed, making detection and removal much more complicated. Initially, Radmin was legitimate software used by IT specialists for administration, but criminals abuse the remote access component by injecting it via Trojan horses. When abused, users completely lose control of their machines.
What can hackers do with Radmin?
Once installed, the RAT tool allows hackers to perform numerous malicious tasks including making screenshots, monitoring your computer usage, and installing additional malware. They can multiply the malware via your network to infect other computers.
Hackers can download and upload malicious files to your system without your knowledge. They can start or shut down applications, steal personal files, and capture keyboard input.
The trojan can modify Windows system services and other settings to gain persistent access. Hackers can potentially access financial accounts, steal credentials, and use your computer for attacking other systems. The level of control granted to hackers is nearly complete.
How does Radmin virus get installed on my PC?
The malware is typically distributed through malicious spam email attachments, with hackers sending thousands of phishing emails using bots. These emails may appear legitimate, closely resembling messages from companies like Amazon or FedEx. Users are tricked into opening dangerous attachments that contain the RAT payload.
The virus can also come from malicious websites or exploit kits that automatically download malware when you visit. Users who open email attachments from unknown senders or click suspicious links are most vulnerable. Never open attachments asking for macro functions to be enabled, as this is a common attack vector.
What symptoms indicate Radmin infection?
Radmin rarely exposes obvious symptoms because its goal is remaining undetected during malicious activities. However, you may notice occasional freezes or crashes as the RAT consumes system resources. Increased CPU usage may spike unpredictably.
Your computer performance degrades noticeably due to the trojan running in background. An increased amount of advertisements may appear on your browsers. You may experience overall sluggish PC performance.
Some users report unexpected system shutdowns or restarts. However, many Radmin infections show no obvious symptoms, allowing hackers to operate covertly for extended periods. This stealthy nature makes Radmin particularly dangerous.
What files and modifications does Radmin create?
Once injected, Radmin creates specific files and modifies Windows services. System services normally used by Windows are replaced by malicious executables running in Task Manager.
Malware modifies other settings to gain persistence and remain active even after computer restarts. These changes are designed to survive standard removal procedures. The trojan may hide files or modify registry entries to prevent detection.
Some modifications target security software to disable protective features. These deep system-level changes make manual removal extremely complicated. Professional security software is necessary to find and remove all modifications the trojan makes.
How dangerous is Radmin compared to other malware?
Radmin is extremely dangerous because it grants attackers nearly complete control over your machine. Unlike ransomware that encrypts files or adware that displays ads, Radmin allows ongoing unauthorized access.
Information tracking enabled by this trojan can lead to identity theft or stolen money directly from bank accounts. Hackers can use your computer for botnet attacks targeting other systems.
Your machine becomes a liability to others on your network. Radmin opens doors to other malware installations like ransomware or digital currency miners. These cyber threats compound over time as multiple infections accumulate on the compromised system.
How do I remove Radmin virus?
Download and install security software capable of detecting and removing RAT trojans. Windows Defender or professional antivirus programs can identify Radmin. Beware that the trojan deletes its executable making detection complicated.
Perform complete scans with your security software, preferably in Safe Mode with Networking where the malware has fewer defenses. Some components may hide deeply in your system requiring thorough scanning.
After removal, use system repair tools to fix any damage caused by the trojan. Verify complete removal by running additional scans with different security software. Monitor your system for several weeks following removal to ensure no components resurface.
Should I use Safe Mode for removal?
Yes, absolutely. Entering Safe Mode with Networking is essential for complete Radmin removal because malware has reduced capabilities in this mode. Malware cannot defend itself as effectively against removal tools running in Safe Mode.
System services and non-essential processes do not start, giving security software better access to infected files. Press F8 during boot to access Advanced Boot Options and select Safe Mode with Networking.
From Safe Mode, launch your antivirus software and perform complete system scans. This approach has significantly higher success rates for persistent trojans that resist removal in normal Windows mode. Reboot to normal mode only after confirming complete removal through scans.
How can I prevent Radmin infection?
Never open email attachments from unknown senders, especially if they ask for macro functions to be enabled. Carefully examine email addresses to verify legitimacy before trusting sender identity.
Place cursor on suspicious links to reveal where they actually lead before clicking. Check the "From" address carefully, as this reveals email spoofing.
Keep your operating system and all software updated with latest security patches. Install reputable antivirus software with real-time protection. Stay informed about common phishing and social engineering tactics.
Be skeptical of unexpected emails requesting personal information or asking you to click links. Use email security features to filter suspicious messages. Backup important files regularly to external drives in case of infection.
Will Fortect remove RadMin?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For RadMin, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Wikipedia: Trojan horse (computing) (read October 5, 2026)
- SearchSecurity: Identity theft (read October 5, 2026)
- UsunWirusa: UsunWirusa (read October 5, 2026)
- FTC: How to recognize, remove and avoid malware (read October 5, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 5, 2026)