ValleyRAT (Winos) Removal Guide for Windows: Offline Scan, Account Security and PC Reset

What ValleyRAT actually is​

ValleyRAT, also called Winos or Winos 4.0, is a remote access trojan for Windows. Once it runs, someone else can watch your screen, run commands and install more malware. According to Kaspersky's Securelist, it is ValleyRAT (Winos 4.0) in the same family, and CyCraft describes it as a modular Windows Remote Access Trojan (RAT).

Is it a virus? Not in the strict sense. It does not copy itself from one PC to another. Someone has to run the first file, such as a fake installer, a program made to look like a document, or something hidden in an archive. After that it acts as a remote control tool and as a loader for more malware. That's a bit like the difference between catching a cold and handing a stranger your house keys. For the victim, a confirmed run is a full compromise either way.

Some background from security researchers:

• Origins and lineage. The Hacker News, citing Rapid7, reports that built atop the foundations of a known remote access trojan called Gh0st RAT, Winos 4.0 is an advanced malicious framework written in C++. Sources disagree on when it was first documented. That report credits Trend Micro in June 2024, while ANY.RUN and Check Point Research point to early 2023.
• Who is behind it. Many campaigns are linked to a group known as Silver Fox (also called Void Arachne). Attribution has become shakier, though. Check Point Research's December 2025 analysis says the ValleyRAT builder leaked publicly in March 2025, so anyone can now compile and deploy the malware. Tying a given infection to one specific group is therefore unreliable.
• Who gets targeted. Most reported victims are Chinese-speaking users, often in finance, e-commerce, sales and management. Kaspersky said it detected the backdoor more than 100,000 times in 2026, affecting over 1,500 unique users, mainly in China and India. Nothing stops it from running on a PC anywhere else.

How active is it right now?​

The guide that prompted this piece counted 12 ThreatFox entries and 12 MalwareBazaar samples tagged ValleyRAT in its abuse.ch data. The newest arrived between October 18 and October 21, 2026. These numbers show the family is still being collected. They are not victim counts. ThreatFox lists indicators such as controller addresses, and MalwareBazaar stores submitted samples. A family tag doesn't say who was hit.

Section summary: ValleyRAT is an active, modular Windows RAT. It is a trojan rather than a self-spreading virus, and a person has to run something to get infected.

How it gets onto a PC​

Nobody gets ValleyRAT just by viewing a web page. The lure changes from campaign to campaign, but the pattern is always that someone runs a file:

• Fake security software. Malwarebytes reported in February 2026 that a convincing lookalike of the popular Huorong Security antivirus has been used to deliver ValleyRAT. Yes, people downloaded a "security tool" and got a RAT.
• Fake VPN and browser installers. Rapid7 found fake software installers masquerading as popular tools like LetsVPN and QQ Browser.
• Trojanized adware. Kaspersky's August 31, 2026 report describes an installer that drops a modified copy of the QN Wallpaper app and disables Windows Defender via the registry before a signed process sideloads a malicious DLL.
• Phishing. CyCraft warned in April 2026 about tax-filing spear phishing in Taiwan. Fortinet's 2024 analysis found first-stage files posing as financial documents with Office icons.

DLL sideloading shows up again and again. A real, signed program is tricked into loading a malicious library sitting next to it, so the malicious code runs under a process that looks trustworthy.

Why a clean scan doesn't settle it​

ValleyRAT goes after the tools you'd use to find it:

• Fortinet reports that some samples add the entire C: drive to Microsoft Defender's exclusions through PowerShell.
• Check Point describes a "driver plugin" with a built-in kernel-mode rootkit. Some of these drivers carried certificates that still worked and could load on fully updated Windows 11 systems, even with HVCI and Secure Boot turned on. Check Point told Microsoft, and Microsoft later revoked a certificate in one case. That does not mean every current sample gets past Windows protections, but it does mean a quiet antivirus is weak evidence.
• Malwarebytes notes that in the Huorong campaign the malware rewrites its own files. Deletion of these files alone may not fully remediate the infection, as the malware demonstrates the ability to re-write core components during execution.

That last point matters for anyone planning to clean up by hand. Deleting the files you can see may only work until the malware puts them back.

Section summary: a clean scan is one data point, not a clean bill of health. Treat it that way.

Step 1: Work out whether anything actually ran​

Start with one question. Did you run an unknown installer, a document that pushed you to open it, or an archive from a person or site you don't fully trust?

• No: a name in a news story or a scan log is not a reason to panic. A detection may mean a file was blocked. Update Windows and your security software, and keep an eye on your accounts.
• Yes, or not sure: stop using the PC for banking, email, work or crypto. Disconnect it from Wi-Fi or Ethernet if you can, because a RAT needs a connection to be useful to its operator.
• Work computer: call your IT or security team before you delete anything. Removing traces yourself can destroy evidence they need.

Step 2: Look for traces without deleting anything yet​

The guide lists places to check. These are leads from specific 2024–2025 samples analysed by Fortinet and Check Point. They are not a universal signature, and they are not a list of things to delete. Other builds may use different names.

Then open Windows Security > Virus & threat protection > Protection history. Look for detections, blocked items or quarantined files from around the time you ran the suspicious file. Fortinet's detection name for the family is W64/ValleyRat.A!tr.spy. The guide found no published Microsoft detection name. That is not proof that Defender can't catch samples.

What the results mean: finding the Termaintor service or the RunTime folder is a strong sign. Finding none of them proves nothing.

Step 3: Secure your accounts from another device​

Do this before you start cleaning the PC, and do it from a phone or a computer you trust:

1. Change your email password first. That account controls password resets for everything else.
2. Then change passwords for banking, shopping, social and gaming accounts.
3. Use each service's sign out of all other sessions option. Stolen session cookies can keep an attacker logged in even after you change the password.
4. Turn on two-step verification, ideally with an authenticator app or a security key, and check your recovery email and phone number.

This order follows from what the malware has been seen doing. Kaspersky documented the backdoor logging keystrokes, capturing clipboard contents, taking screenshots and downloading more modules. If it ran, assume your saved browser passwords and any accounts that were open are exposed.

Step 4: Scan, including offline​

1. Open Windows Security > Virus & threat protection > Scan options.
2. Run a Full scan and remove anything it finds.
3. Back in Scan options, select Microsoft Defender Antivirus (offline scan) and click Scan now. Save your work first, because Windows restarts and scans before it fully loads. This can catch files that hide while Windows is running. The guide puts the offline scan at roughly 15 minutes. That figure covers only the scan, not the whole cleanup.
4. A second opinion from another vendor's scanner is reasonable. No scanner's clean result guarantees a clean PC with this family.

For manual cleanup: if a scheduled task looks suspicious, check its Actions tab to see what it runs before you delete it. Leave tasks that belong to Microsoft, your PC maker or apps you actually use. If you find a driver loading at startup, don't try to remove it by hand. Go to the next step.

Step 5: When in doubt, reset Windows​

If you found driver traces, can't tell what's safe to delete, or simply don't trust the machine anymore:

1. Back up personal documents and photos only.
2. Go to Settings > System > Recovery > Reset this PC and choose Remove everything.
3. Copy your documents back by hand. Don't restore programs, and don't restore a full system image taken after the suspicious file ran.
4. Reinstall apps from their makers' official sites.

A full wipe works without you having to find every piece of the malware, which is the main appeal against something with rootkit features. It does not undo what has already been stolen. Anything that was on the PC, such as passwords, open sessions or crypto seed phrases, stays exposed until you change it from a clean device.

How far to trust this procedure​

This plan is useful, but it has limits. The guide that prompted this piece says its author ran no ValleyRAT sample, infected no PC, and never tried the cleanup order on a live infection. It also says it found no vendor-published, tested removal procedure for ValleyRAT. So the steps above are reasonable incident response based on published research, not a cure tested against real infections. The guide also repeatedly promotes a paid third-party scanner. Nothing in the research supports claims about that product, and nothing here depends on it.

For businesses, Kaspersky's advice fits well: train staff to spot these lures and enforce clear rules about third-party software on work devices. For home users, the most useful habit is the one this malware relies on people skipping. Never add an app with a questionable reputation to your antivirus exclusions, because some ValleyRAT samples add those exclusions for themselves.

Bottom line: a ValleyRAT name in a log is a reason to ask questions. A confirmed run is a reason to secure your accounts from another device, scan offline, and seriously consider a full reset.