Rustock: what it is and how to remove it
Rustock is a stealthy backdoor virus that creates users' computers into spam machines. It targeting Windows operating systems and was able to send out as much as 192 spam messages per device per minute, resulting in a staggering amount of infections worldwide - security experts predict that the number may vary from 150,000 to 2,400,000 machines worldwide.
Facts checked October 7, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation. Sections marked as our earlier report are the original text: they describe the threat as it was then and have not been reviewed since. The 2026 status, the removal steps and the questions are current.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
After Defender reports Backdoor:Win32/Rustock, an automatic scan can look for related files it may have missed.
Do it yourself · free Remove Rustock yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Rustock: summary
| Detection names | No Microsoft detection name is known |
|---|---|
| Distribution | Not recorded in the old report |
| Damage | Not recorded in the old report |
| Name | Rustock |
| Type | Remote access trojan |
| Symptoms | A Windows Security "Threats found" notification |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 4 more facts
| Evidence | 5 write-ups by security sites; details still limited |
|---|---|
| First seen | 5 July 2018 |
| Microsoft Defender name | Backdoor:Win32/Rustock |
| Facts checked | 7 October 2026 |
What Rustock does on an infected PC
From our report of Jul 2018 · not reviewed since
Rustock - a trojan horse that is responsible for one of the largest botnets that ever existed
Rustock is a stealthy backdoor virus that creates users' computers into spam machines.
It targeting Windows operating systems and was able to send out as much as 192 spam messages per device per minute, resulting in a staggering amount of infections worldwide - security experts predict that the number may vary from 150,000 to 2,400,000 machines worldwide.
The malicious code used TLS encryption in order to hide the presence of malware. The virus operated from 2006 and was finally taken down in 2011 by the what is known to be the Operation b107.
The backdoor trojan is an extremely stealthy threat which is capable of multiplying itself fast. As soon as Backdoor:Win32/Rustock virus enters the machine, it uses rootkit capabilities and hides its registry entries.
Then it seeks the contact with a remote Command & Control server, operated by hackers. Although the parasite does not allow the intruder to control the infected PC, it converts the system to a hidden proxy used for certain malicious purposes.
Users who were infected usually had no idea about it. Thus, Rustock removal was out of the question (that is one of the main reasons why it was able to persist in machines for so long). In some cases, victims could experience the following symptoms:
Because the symptoms, if any, were rather obscure, users usually blamed it on outdated hardware or slow internet, letting the Rustock botnet thrive. Nevertheless, machines that did not have security software installed were extremely vulnerable.
The malware was capable of sending 25,000 spam emails per hour from an infected machine. 40% of global spam traffic was connected to the Rustock botnet. Therefore, US authorities, Microsoft, and other reputable organizations collaborated on what was then called Operation b107 and took it down in 2011. Hackers operated Ninety-six Command & Control servers at the time of the takedown.
The culprits behind the infamous botnet were never caught, although forensic experts pointed at Eastern Europe. Although highly unlikely, cybercriminals might still focus on DDoS or other similar attacks. Nevertheless, in case of the malware returns, users should remove Rustock backdoor using reputable security software.
- High CPU usage
- Program crashes
- Slow internet speed
- Overall sluggish performance of the PC
From our report of Jul 2018 · not reviewed since
More from our earlier report on Rustock
- Rarely any; users may experience system crashes, slowdown of the PC operation, etc.
How Rustock got on your PC
From our report of Jul 2018 · not reviewed since
Initial phishing emails sent by cybercrooks have most likely been done using spam bots.
Although there are technologies available to prevent the malware to infiltrate computers (such as built-in scanner used by email providers, or security software installed on the user's PC), there is no fail-proof method. Nevertheless, it is possible to decrease the probability of such unfortunate events happening.
First of all, users should install security software - it is always the best practice to protect yourself from malware. Additionally, opening spam emails is never a good idea. The problem is that some phishing emails may look extremely believable, and many victims can fall for the trick.
Thus, check for the "From" address, look for spelling/grammar mistakes, and if the email seems suspicious, DO NOT open any attachments (especially those which ask the macro function to be enabled for MS Office documents) or click on hyperlinks inside.
How to check the PC for Rustock
If Windows Security shows Backdoor:Win32/Rustock, it has found Rustock or a file that belongs to it.
Write the name down before you click Remove: it is the most useful search term later, and you will need it if you report the incident.
A family name in the label is more informative than a heuristic one. Our page on why one threat has many antivirus names lists the common formats and what each part means.
How to remove Rustock
How to remove Rustock and lock the attacker out
Someone may have had remote control of the PC.
Cut the connection first, then remove the trojan and secure your accounts.
Step 1: Remove remote access tools and lock the attacker out
Attackers keep access through remote control tools and extra user accounts. Disconnect the PC from the internet, then remove every remote access program you did not install yourself from the installed apps list in Windows 11 or Windows 10.
Look for a user account you do not know and delete it, and switch off Remote Desktop in Settings > System. Reconnect only for the scan.
Full procedure with screenshots: Uninstall a program or app in Windows On uGetFix
Step 2: Delete scheduled tasks that bring it back
Programs like Rustock add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 3: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Rustock that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Rustock can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Instructions for each browser and system
The detailed steps for every browser and system this guide covers. Open the one you use.
Manual removal using Safe Mode
Important! →
Manual removal guide might be too complicated for regular computer users. It requires advanced IT knowledge to be performed correctly (if vital system files are removed or damaged, it might result in full Windows compromise), and it also might take hours to complete. Therefore, we highly advise using the automatic method provided above instead.
Step 1. Access Safe Mode with Networking
Manual malware removal should be best performed in the Safe Mode environment.
Windows 7 / Vista / XP
- Click Start > Shutdown > Restart > OK.
- When your computer becomes active, start pressing F8 button (if that does not work, try F2, F12, Del, etc. - it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
- Select Safe Mode with Networking from the list.
Windows 10 / Windows 8
- Right-click on Start button and select Settings.
- Scroll down to pick Update & Security.
- On the left side of the window, pick Recovery.
- Now scroll down to find Advanced Startup section.
- Click Restart now.
- Select Troubleshoot.
- Go to Advanced options.
- Select Startup Settings.
- Press Restart.
- Now press 5 or click 5) Enable Safe Mode with Networking.
Step 2. Shut down suspicious processes
Windows Task Manager is a useful tool that shows all the processes running in the background. If malware is running a process, you need to shut it down:
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Click on More details.
- Scroll down to Background processes section, and look for anything suspicious.
- Right-click and select Open file location.
- Go back to the process, right-click and pick End Task.
- Delete the contents of the malicious folder.
Step 3. Check program Startup
- Press Ctrl + Shift + Esc on your keyboard to open Windows Task Manager.
- Go to Startup tab.
- Right-click on the suspicious program and pick Disable.
Step 4. Delete virus files
Malware-related files can be found in various places within your computer. Here are instructions that could help you find them:
- Type in Disk Cleanup in Windows search and press Enter.
- Select the drive you want to clean (C: is your main drive by default and is likely to be the one that has malicious files in).
- Scroll through the Files to delete list and select the following:
Temporary Internet Files
Downloads
Recycle Bin
Temporary files - Pick Clean up system files.
- You can also look for other malicious files hidden in the following folders (type these entries in Windows Search and press Enter):
%AppData%
%LocalAppData%
%ProgramData%
%WinDir%
After you are finished, reboot the PC in normal mode.
From our report of Jul 2018 · not reviewed since
Way to remove dangerous Rustock malware
If are unlucky enough and got infected with the cyberthreat, there is a way to remove Rustock virus from your computer.
Users should never rely on doing it manually, as it is almost impossible. Only well-trained IT professionals can execute such uneasy task.
For regular users, however, security researchers recommend using security software for Rustock removal. , or is an excellent choice, although you can pick any other reputable anti-malware program. Just make sure that it is up to date, as the virus databases are updated continually.
[GI=method-1]If Rustock virus denies your security software, enter Safe mode with Networking:
[GI=method-2]Eliminate the malware using System Restore:
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed the Windows Security detection Backdoor:Win32/Rustock, a sign of a program that could read browser data, the clean-up is only half of the work.
The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
Protect your privacy - employ a VPN
There are several ways how to make your online time more private - you can access an incognito tab.
However, there is no secret that even in this mode, you are tracked for advertising purposes. There is a way to add an extra layer of protection and create a completely anonymous web browsing practice with the help of VPN. This software reroutes traffic through different servers, thus leaving your IP address and geolocation in disguise.
Besides, it is based on a strict no-log policy, meaning that no data will be recorded, leaked, and available for both first and third parties. The combination of a secure web browser and VPN will let you browse the Internet without a feeling of being spied or targeted by criminals.
No backups? No problem. Use a data recovery tool
If you wonder how data loss can occur, you should not look any further for answers - human errors, malware attacks, hardware failures, power cuts, natural disasters, or even simple negligence.
In some cases, lost files are extremely important, and many straight out panic when such an unfortunate course of events happen. Due to this, you should always ensure that you prepare proper data backups on a regular basis.
If you were caught by surprise and did not have any backups to restore your files from, not everything is lost. is one of the leading file recovery solutions you can find on the market - it is likely to restore even lost emails or data located on an external device.
Questions about Rustock
What does the name Backdoor:Win32/Rustock tell me?
Microsoft builds names in a fixed order:
- category
- then platform
- then family
- sometimes followed by a variant letter
- a suffix
The category is the most useful part for you. Trojan, Backdoor and PWS mean real malware that can download more, give remote access or steal passwords. PUA means unwanted software.
Ransom means ransomware. Suffixes such as !ml or !MTB mean the detection came from machine learning or behaviour analysis. Search for the family part of Backdoor:Win32/Rustock together with the word Microsoft to find its entry in Microsoft's security encyclopedia.
Why does Backdoor:Win32/Rustock keep coming back?
Because removing the file does not remove what creates it. The usual causes are a scheduled task, a startup entry, a service or a browser extension that downloads or rebuilds the file, or a second program that installed it in the first place.
Look in Task Scheduler and Startup apps for unknown entries, check Installed apps sorted by date, and run a Microsoft Defender Offline scan, which can remove items that are locked while Windows runs. Also check that no exclusions were added in Windows Security. If Backdoor:Win32/Rustock still returns, back up documents and reset Windows.
Is Microsoft Defender enough to remove Rustock?
For most home PCs it is a solid first step. Defender detects this threat as Backdoor:Win32/Rustock, and a full scan followed by an offline scan covers the places where Rustock usually hides. The offline scan runs before Windows starts, so malware that hides while Windows is running cannot interfere: Run a Microsoft Defender Offline scan.
Defender does not undo everything, though. It does not restore browser settings, decrypt files or change passwords that may have been copied, which is why this guide has separate steps for those. If Defender finds the same item again after removal, something else keeps reinstalling it.
I found AnyDesk or ScreenConnect that I did not install. Is that Rustock?
Not necessarily Rustock, but it is a warning sign. These are legitimate remote support tools, and criminals use them as ready-made backdoors, especially after tech support scams or fake invoice calls.
If you did not install it and no one you trust set it up, uninstall it, change passwords from a clean device and check your bank account. If someone connected to your PC through it, follow the steps for remote access trojans and consider a Windows reset. Installed apps sorted by date shows when it appeared.
How do I know if my PC has Rustock?
Often you do not, which is the point of a trojan. Possible signs are an antivirus alert naming Rustock or a generic trojan detection, unknown programs or scheduled tasks, processes with random names in Task Manager, browser extensions you did not add, security settings turned off, slower performance, or account alerts about logins from unknown places.
The reliable check is a full scan followed by Microsoft Defender's offline scan. If you recently ran a crack, a fake installer or a command a website told you to paste, scan even without symptoms.
Do I need to reinstall Windows to get rid of Rustock?
Usually not. A thorough clean-up is enough when the offline scan finds nothing afterwards and you do not see the Windows Security detection Backdoor:Win32/Rustock again. A reset is the safer choice if an attacker had remote control, if security tools were switched off, or if detections come back after every clean-up.
Windows 11 can reset itself without a USB stick under Settings > System > Recovery > Reset this PC. Copy documents and photos out first and scan the copies. A reset does not change passwords or undo stolen data, so the account steps still apply.
Why can't I find Rustock in antivirus databases?
Because it is new or because it is listed under a different name. Antivirus companies name threats after the family they belong to, and a program that appears as Rustock on your PC may carry a generic or unrelated label in their databases.
Many new samples are first detected only by behaviour, without a family name. What you saw, the Windows Security detection Backdoor:Win32/Rustock, is enough to act on:
- end the program
- remove its startup entry
- run a Microsoft Defender offline scan
- secure your accounts
A detection name from a scan is worth noting for later.
Is it safe to do online banking after seeing the Windows Security detection Backdoor:Win32/Rustock?
Not on that PC until it is clean. A program that produces the Windows Security detection Backdoor:Win32/Rustock runs with your rights and could read what you type or what the browser shows. Use a phone or another computer for banking and for changing passwords.
When the offline scan of the affected PC is clean and nothing suspicious starts with Windows any more, you can go back to using it. Check your bank statements for the past weeks either way, and call the bank if anything looks unfamiliar; banks can block cards and reset access quickly.
My antivirus was on. How did a trojan get past it?
Antivirus programs see a file only when it is written or run, and criminals test each new build against popular scanners before release. Detection catches up within hours or days, which is often after the first victims ran it.
Archives with passwords, installers that fetch the malware later, and scripts run through PowerShell make the job harder. That is why behaviour such as downloading cracks or pasting commands matters more than any setting. Keep Windows and Defender updated, and turn on Reputation-based protection in App & browser control.
Will Fortect remove Rustock?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Rustock, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- SearchSecurity: Transport Layer Security (TLS) (read October 7, 2026)
- The Register: RUSTOCK TAKEDOWN: How the world's worst botnet was KO'd (read October 7, 2026)
- FTC: How to recognize, remove and avoid malware (read October 7, 2026)
- Microsoft Learn: Microsoft Defender Offline (read October 7, 2026)
- Microsoft Learn: How Microsoft names malware (read October 7, 2026)