How to Remove Botnet Malware From an Infected Device

Your computer might be working for a cybercriminal right now — sending spam, attacking websites, or mining cryptocurrency — and you might have no idea. Botnets are networks of infected devices ("bots") controlled remotely by an attacker. Unlike ransomware, botnet malware typically tries to stay hidden, since a device that's been formatted is no longer useful to the operator. This guide shows you how to detect and remove botnet malware.

What Is Botnet Malware?¶

Botnet malware (also called a "bot" or "zombie" agent) is malicious software that enrolls your device in a remotely controlled network. Once infected, your device receives commands from the attacker's command-and-control (C2) server and executes them.

Botnet operators use infected devices for:
- Spam campaigns: Sending millions of phishing or spam emails through victims' IP addresses
- DDoS attacks: Flooding target websites with traffic from thousands of infected machines
- Credential stuffing: Automating login attempts against websites using stolen credential lists
- Cryptocurrency mining: Using victims' processing power to mine Monero or other coins
- Click fraud: Generating fraudulent ad clicks on behalf of advertisers
- Malware distribution: Delivering further malware payloads to victims or using infected machines as relay servers

Signs Your Device Might Be in a Botnet¶

Botnet malware is designed to be invisible, but several signs can suggest infection:

• Unusual network activity: High data transfer volumes even when you're not using the internet. Check your router's traffic monitor.
• System slowdowns: Unexpected CPU or GPU usage — open Task Manager and look for unknown processes consuming significant resources.
• Slow internet: Your connection seems slower than usual — your bandwidth is being used for DDoS or spam.
• Overheating: Persistent high CPU usage causes excessive heat.
• Email bouncebacks: Receiving delivery failure notifications for emails you never sent (your device may be sending spam).
• Your IP is blacklisted: Websites reject your connections, or your ISP contacts you about suspicious traffic. Check your IP at mxtoolbox.com/blacklists.aspx.
• Antivirus disabled: Some botnet malware disables security software on arrival.

How to Remove Botnet Malware¶

Step 1: Verify Suspicious Activity¶

Before panicking, confirm there's actually a problem:

Open Task Manager (Ctrl+Shift+Esc) and sort processes by CPU and network usage. Note any unknown processes with high activity.

Run Resource Monitor (Windows: search "resmon") and check the Network tab for processes making unexpected outbound connections.

Use netstat -ano in Command Prompt to see all active network connections and the process IDs behind them.

Step 2: Disconnect from the Internet¶

Disconnecting prevents the botnet operator from sending further commands and stops any ongoing data exfiltration or attack traffic. Unplug your ethernet cable and disable WiFi before proceeding.

Step 3: Boot into Safe Mode with Networking¶

Safe Mode prevents most malware from autostarting, which makes it easier to detect and remove:

Windows 10/11: Settings > System > Recovery > Advanced Startup > Restart now > Troubleshoot > Advanced Options > Startup Settings > Restart > Press 5 (Safe Mode with Networking)

You'll need networking to update antivirus definitions.

Step 4: Update and Run Malwarebytes¶

Download or update Malwarebytes and run a full scan. Malwarebytes is effective against botnet agents including common families like Emotet, TrickBot, Mirai variants (on compatible platforms), and generic bot clients.

Step 5: Run a Second-Opinion Scanner¶

After Malwarebytes, run:
- ESET Online Scanner (free, no installation): Scans for threats that Malwarebytes may miss
- Kaspersky Virus Removal Tool (free): Excellent detection rates
- HitmanPro: Effective at catching persistent botnet components

Using two scanners significantly increases the chance of complete removal.

Step 6: Check and Clean Startup Items¶

Botnet malware persists through startup mechanisms:

• Task Manager > Startup tab: Disable unknown entries
• Task Scheduler (taskschd.msc): Look for tasks with random names or tasks pointing to unusual directories
• Registry Run keys (Registry Editor > HKCU\Software\Microsoft\Windows\CurrentVersion\Run and HKLM\Software\Microsoft\Windows\CurrentVersion\Run): Delete unknown entries
• Services (services.msc): Look for services with unusual names or descriptions

Step 7: Check for Rootkit Components¶

Some advanced botnet malware uses rootkits to hide from standard scans:

Run GMER (gmer.net) — a rootkit scanner that operates at a low level to detect hidden processes, files, and drivers.

Run TDSSKiller (from Kaspersky) — specifically designed to detect rootkits like TDL4/TDSS.

Step 8: Reset Network Settings¶

Botnet malware sometimes modifies DNS settings to prevent security tool updates or redirect traffic:

• Check your DNS settings: Settings > Network > Advanced DNS. Should be automatic or set to trusted resolvers (8.8.8.8, 1.1.1.1), not unknown IPs.
• Check the Windows hosts file: Notepad (as admin) > Open C:\Windows\System32\drivers\etc\hosts — remove any unexpected entries.

Step 9: Change All Passwords¶

Assume any credentials typed on the infected machine are compromised. Change passwords for:
- Email accounts
- Banking and financial services
- Work applications
- Social media
- Any site where you reuse passwords

Change these from a clean device.

Step 10: Consider a Clean Reinstall¶

For peace of mind — particularly in business environments — a clean OS installation is the most reliable solution. Reformat the drive, reinstall Windows, and restore from a pre-infection backup.

For IoT Devices (Routers, Smart TVs, Cameras)¶

Many botnets (Mirai, Moobot, Emotet's IoT variants) target Internet of Things devices rather than computers. Signs include:
- Router admin page is inaccessible or settings were changed
- Devices generating unusual network traffic

Solution:
1. Factory reset the device
2. Update firmware to the latest version immediately after reset
3. Change default admin credentials
4. Disable remote management if not needed
5. Consider placing IoT devices on a separate network VLAN

FAQ¶

Will restarting my computer remove botnet malware?
No — a simple restart doesn't remove malware. Most botnet agents establish persistence through startup mechanisms that survive reboots.

Can my router be part of a botnet?
Yes. Routers running outdated firmware or using default credentials are common botnet targets. The Mirai botnet primarily targeted routers and IoT devices.

How did botnet malware get on my device?
Common vectors: clicking a malicious email attachment, downloading software from unofficial sources, unpatched software vulnerabilities, or visiting a compromised website with drive-by download capability.

Will my ISP detect if I'm in a botnet?
Some ISPs monitor for botnet traffic patterns and notify customers. ISPs participating in the Messaging, Malware, and Mobile Anti-Abuse Working Group (M3AAWG) actively investigate and notify infected customers.

This article is published by ScamSandbox to help users understand and avoid malware threats and online scams.