NexusRAT Removal Guide: Stop Banking Overlays and Clean Your Windows PC

A document arrives by email, and the attachment looks like an image. You open it expecting paperwork, then another download appears.

If NexusRAT has appeared in a security alert, the details of that download matter. Start with what happened, not what the attachment seemed to be.

Overview

This NexusRAT campaign targets Windows banking activity

NexusRAT is a remote-access banking threat associated with fake login overlays and keystroke capture. An overlay places a deceptive window over something you recognize.

The Windows delivery chain examined here starts with an emailed SVG attachment. A linked page supplies a ZIP archive containing a VBS script.

Executing that script is a materially different exposure from receiving the message. The infection account does not establish that merely viewing an inbox installs NexusRAT.

Keep this Windows campaign separate from Android banking malware also called Nexus. Similar names do not justify Android permission instructions for a Windows script infection.

A genuine banking address does not protect an infected desktop

The reported malware watches for targeted banking activity and displays a convincing substitute interface. The person can be looking toward their bank while typing into an attacker’s window.

That distinction explains why checking a web address alone is insufficient after malware runs. The problem can be on the computer, not the bank’s server.

The useful questions are practical:

• Did the attachment launch a page or download another file?
• Was the archive extracted, and was its script executed?
• Which financial accounts were used afterward?
• Did a security tool identify a file, process, or execution chain?

Cleanup and financial protection need separate attention

A scanner can quarantine detected components. It cannot cancel a bank transfer, retrieve copied credentials, or decide whether a particular login was authorized.

Contact the bank promptly if the script ran and banking credentials were subsequently entered. Make that contact from another device or a trusted telephone.

How to Remove NexusRAT From Windows

For a work or school computer, contact its IT or security team before installing tools or restarting. Its investigation may need evidence from the running system.

If remote access is suspected, disconnect Wi-Fi or Ethernet and stop using this PC for sensitive accounts. Arrange trusted downloads and updates before proceeding with cleanup.

Start with Malwarebytes. HitmanPro and ESET are optional second opinions for unresolved findings or continuing symptoms. Run one scanner at a time.

• STEP 1: Use RKill only if malware blocks your scanner
• STEP 2: Scan and quarantine threats with Malwarebytes
• STEP 3: Optional: Check unresolved threats with HitmanPro
• STEP 4: Optional: Run a second-opinion scan with ESET

Step 1: Use RKill only if malware blocks your scanner

RKill attempts to stop known malware processes so your security software can run. It does not remove the infection.

Use it only on a personal Windows PC when malware is blocking your scanner. Otherwise, skip directly to Malwarebytes.

1. Download Rkill.

   Download RKill using the button below. On the download page, choose the iExplore.exe version.

   This is a renamed copy of RKill, provided for infections that block security tools by filename.

   RKillStops malware processes so other tools can run

   Download RKillOpens the BleepingComputer download page in a new tab.

2. Run RKill.

   Open your Downloads folder and double-click iExplore.exe. Allow the program time to finish checking for processes that interfere with cleanup.

   

   When the black window closes, a log opens. Keep the log, do not restart yet, and continue directly to Malwarebytes.

Step 2: Scan and quarantine threats with Malwarebytes

Malwarebytes for Windows can scan for malware and quarantine detected threats. Use the free Custom Scan below; a paid plan is not required for this cleanup.

1. Download Malwarebytes

   Click the button below to download Malwarebytes for Windows. Paid real-time protection is optional.

   Malwarebytes Free for WindowsScans and removes malware at no cost

   Download MalwarebytesMalwarebytes free scanner informationOfficial installer for Windows 11 and 10. Your download starts right away.Want real-time protection? See Malwarebytes Premium

2. Install Malwarebytes

   When the download finishes, open Downloads and double-click MBSetup. If Windows asks for permission, check that the prompt identifies Malwarebytes, then click Yes.

   

3. Follow the On-Screen Prompts to Install Malwarebytes

   The setup wizard will walk you through a few quick screens:

   Installer screens and optional offers vary. Skip unwanted Browser Guard, trial, or paid-plan offers. The free Custom Scan remains available; Threat Scan may require a paid plan.

   • Choose Personal for your own computer, then click Next. For a work-managed device, use your organization’s approved response instead.

     

   • Wait for installation to finish.

     

   • If the Welcome to Malwarebytes screen appears, click Get started and follow the remaining prompts.

     

   • On the final screen, click Open Malwarebytes to launch the program.

     

4. Choose the scan type and optional rootkit check

   On the Scanner tile, click the three dots, choose Advanced Scan, then Custom Scan.

   Expand the folder selector and select the C:\ system drive. Include any other drive where the suspicious files were stored.

   If Scan for rootkits is available, you can enable it. This setting is unavailable on Windows ARM devices; leave Windows security protections enabled.

   Review how potentially unwanted programs and modifications will be handled. Keep detection enabled rather than automatically ignoring these items.

5. Start the Scan

   Click Start Custom Scan. Allow Malwarebytes to update its detection information if prompted.

6. Wait for the Scan to Finish

   Wait for the Custom Scan to finish. The time required depends on the selected locations and the amount of data.

7. Quarantine the Detected Threats

   When the scan finishes, review the detections and keep the threats you want removed selected. Click Quarantine.

   If a detection is unclear, save the report and ask for help before excluding or restoring it.

   

   Wait while Malwarebytes quarantines the selected items. Do not restore a file merely because an unfamiliar name appears in the results.

   

8. Restart Your Computer

   If Malwarebytes asks for a restart, save your work and click Yes. After signing back in, reopen Malwarebytes and check the report for unresolved detections.

   

Step 3: Optional: Check unresolved threats with HitmanPro

HitmanPro is a second-opinion scanner for Windows. It examines suspicious files using cloud analysis, including SophosLabs. An internet connection is needed for that check.

Scanning is free. Removing detections requires an eligible one-time 30-day trial or a paid license.

A computer that already used its trial may not qualify again. You do not have to buy HitmanPro to follow the Malwarebytes cleanup above.

1. Download HitmanPro

   Click the button below to download HitmanPro if you want a second opinion on unresolved symptoms or detections.

   HitmanProSecond-opinion malware scanner from Sophos

   Download HitmanProFree scan. Removal requires an eligible 30-day trial or a paid license. Opens the official HitmanPro page in a new tab.

2. Install HitmanPro

   When the download finishes, open your Downloads folder and double-click the file: “hitmanpro.exe” on 32-bit Windows, or “hitmanpro_x64.exe” on 64-bit Windows.

   

   If a User Account Control pop-up asks whether HitmanPro can make changes to your device, click “Yes” to continue.

   

3. Follow the On-Screen Prompts

   On the HitmanPro start screen, click Next. Read and accept the terms if you agree, then continue.

   

   Choose whether to keep a copy for later use or run a one-time scan. Review optional startup and email preferences, then click Next.

   

4. Wait for the Scan to Finish

   Let HitmanPro finish scanning. Review its findings once the scan has completed.

   

5. Review the Results and Click “Next”

   Review the detected items and their proposed actions. Save the log if you need help with an unfamiliar detection, then click Next to proceed.

   

6. Click “Activate Free License”

   If this computer qualifies, click Activate free license and follow the activation prompts.

   If no trial is available, use an existing license or save the report for assistance. Do not assume a purchase is necessary to continue cleanup.

   

   After removal, review the summary and click Next. Choose Reboot if requested, or Close if no restart is needed.

   If detections return or the original symptoms persist, keep the reports and ask for help. A clean scan cannot rule out every threat.

Step 4: Optional: Run a second-opinion scan with ESET

ESET Online Scanner is a free second-opinion scanner for Windows. Use it if you need another check after cleanup, rather than running several scanners together.

1. Download ESET Online Scanner

   Click the button below to download ESET Online Scanner.

   ESET Online ScannerFree one-time malware scan from ESET

   Download ESET Online ScannerOpens the official download page in a new tab.

2. Run the Installer

   When the download finishes, open Downloads and double-click esetonlinescanner.exe. Approve the Windows permission prompt after checking that it identifies ESET.

   

3. Install ESET Online Scanner

   On the start screen, select your language from the drop-down menu and click Get started.

   

   Read the Terms of use. Click Accept if you agree, then Get started if that screen appears again.

   

   Choose your preferences for the Customer Experience Improvement Program and the Detection feedback system (either choice is fine), then click Continue.

   

4. Start a Full Scan

   Click Full Scan for a broader check than the quick-scan option.

   

   Select Enable for Detection of Potentially Unwanted Applications. Then click Start scan.

   

5. Wait for the Scan to Finish

   Allow the detection modules to download and update. The file scan begins afterward.

   Leave the scan running until it finishes. A full scan can take an hour or longer, depending on your computer and the data being checked.

   

6. Review the Results

   When the scan finishes, open View detailed results and check the action recorded for each detection.

   ESET attempts to clean and quarantine detected threats. If an item remains unresolved, keep its details for assistance.

   Click Save scan log to keep the results. Then click Continue.

   

   Restart if ESET requests it. Afterward, check whether detections or the original symptoms return.

   If problems continue, keep the scan reports and ask for help in the MalwareTips removal forum. Do not repeatedly restore quarantined files.

Technical Details Worth Knowing

An image attachment invites another action

SVG is an image format, but an SVG document can also contain links and active content. An image-like appearance does not make every interaction harmless.

In this delivery chain, the attachment contains an image that leads onward when clicked. The apparent document is a bridge to a different resource.

A browser page delivers a compressed archive

The attachment’s link opens a page using a blob URL. Browsers use blob URLs for legitimate locally created content too, so that prefix alone is not a verdict.

Here, the important behavior is the next download: a ZIP archive carrying a VBS file. The expected document has become something Windows can execute.

Running the VBS file crosses the execution boundary

A VBS file contains instructions for Windows Script Host. It is not simply another page of an invoice, even when its displayed filename suggests paperwork.

The malware imitates a targeted bank’s interface

The described toolkit includes a collection of banking-interface images. Browser activity helps it choose when to display a matching overlay.

Captured information creates an account problem elsewhere

Keystroke capture can expose information entered through the imitation. Stolen credentials are useful to an attacker even after the infected computer has been disconnected.

What Your Bank Needs to Know

Tell the fraud team that Windows malware may have captured your login. Describe the script execution and subsequent banking activity rather than reporting only a suspicious email.

Explain whether you entered a password, approved an authentication request, or initiated any transfer. Include the approximate times, account involved, and transaction reference where available.

Ask the bank to review access and unauthorized payments. It may need to revoke sessions, replace credentials, restrict transactions, or handle an account-specific recovery process.

Never move funds to a supposedly safe account on a caller’s instructions. Independently call the number on your bank card or use its established application.

If a payment is unfamiliar, report it immediately. Do not wait for a complete malware diagnosis before asking whether a transfer can be stopped or recalled.

What to Do If You Ran the Attachment’s Script

1. Stop sensitive activity on that PC. Disconnect its network connection and avoid signing into anything else while the compromise is being assessed.

2. Notify the financial institution. Use a separate trusted device and explain possible banking-credential capture, including any transactions you do not recognize.

3. Secure the recovery account. Change exposed email credentials, inspect recovery details, and end unfamiliar sessions before relying on that inbox for other resets.

4. Document the chain. Retain the original email, download names, security reports, and relevant timestamps. Do not forward an executable attachment to friends for testing.

5. Arrange malware removal. Follow the Windows procedure above for a personal device. An employer’s computer should go through its security team instead.

6. Watch for follow-up approaches. A caller claiming to reverse the incident should not receive remote access, bank codes, or an advance recovery fee.

After Quarantine: Check the Banking and Email Accounts

Use a known-good computer to review recent sign-ins, saved beneficiaries, standing instructions, and payment changes. Ask the institution about anything you cannot explain.

Check email forwarding rules and unfamiliar connected applications. An intruder who retains mailbox access can intercept warnings or restart account recovery after a password change.

Keep any bank case number alongside the scan report. Together they connect the device incident with its financial consequences without assuming every later charge is related.

Restore ordinary banking use only when the computer is trustworthy again. A bank’s successful password reset is not a technical clearance for Windows.

Frequently Asked Questions

Is this the same threat as the Android Nexus banking Trojan?

This article addresses the Windows SVG-to-VBS campaign described as NexusRAT. Do not apply its cleanup steps to an Android phone merely because a detection name overlaps.

Can an SVG attachment really lead to malware?

Yes. This case uses an SVG as a route to another page and a malicious download. That does not make every SVG image dangerous.

Am I infected if I only downloaded the ZIP?

A saved archive alone does not establish script execution. Avoid opening it, check existing alerts, and tell a responder exactly which actions you took.

Does the fake banking screen mean my bank was hacked?

No. A local overlay can imitate a bank without compromising its systems. The bank still needs to know that your credentials may have been exposed.

Will removing NexusRAT restore money taken from my account?

Removal addresses detected malware, not payments. Contact the bank’s fraud team separately and follow its process for reporting unauthorized transactions.

Should I erase Windows immediately?

Not without preserving essential files and considering evidence needs. A confirmed compromise may justify rebuilding, but that decision needs a recovery plan.

The Bottom Line

Do not run a script supplied through an unexpected document email. NexusRAT’s Windows delivery chain turns that extra download into a banking-account risk.

If it already ran, isolate the PC, contact your bank through a trusted route, and complete device cleanup alongside account and session recovery.