Cobalt Malware Removal (Jan. 2019 Update)

This page aims to help you remove Cobalt Malware. Our removal instructions work for every version of Windows.

If you are one of the victims, who have been infected with a Trojan horse called Cobalt malware, then you are welcomed to our page. Here, we have gathered all the most important information about this new danger. Additionally, we have published a Removal Guide, which is designed with the sole aim to help you remove Cobalt Malware  and all of its nasty scripts from your system. You are very fortunate that you have managed to detect this tricky Trojan in the first place, because such threats are usually very difficult to spot. What is more, many users are not able to remove them before they have performed some fatal harassing actions. For instance, the criminals, who control Cobalt , may use it to gain full control over your PC. They may involve the computer in botnet activities, including spam and virus distribution, cryptocurrency mining and other criminal tasks. Without your knowledge, the hackers may use the Trojan as a backdoor and insert various nasty viruses inside your system, including Ransomware, which is a popular tool for online blackmail. Or, they may corrupt all the data and the software found inside the system, leaving the machine totally useless. All in all, your computer can be exploited in various ways, none of which will do any good to you, your OS or your data. But, now, since you found this guide, you will hopefully manage to eliminate the infection with the help of the instructions and save yourself from such dreadful malicious actions.

What do I need to know about Trojan horses such as Cobalt Malware?

It is very likely that you have heard about Trojan horses in one way or another. These threats are very popular tools for online fraud and theft and as per the recent statistics, they can be blamed for more than 70% of all malware infections that happen throughout the Internet. But do you know how dangerous a Trojan horse can be? How and where it spreads? How to protect your computer? Let us give you some clarity on these questions and provide you with some useful information about one of the newest Trojans that has been detected – Cobalt.

Cobalt Malware Removal



Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).



Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab. Try to determine which processes are dangerous. 


Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Drag and Drop Files Here to Scan
Maximum file size: 128MB.

This scanner is free and will always remain free for our website's users. You can find its full-page version at:

Scan Results

Virus Scanner Result

After you open their folder, end the processes that are infected, then delete their folders. 

Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 


Hold together the Start Key and R. Type appwiz.cpl –> OK.


You are now in the Control Panel. Look for suspicious entries. Uninstall it/them. If you see a screen like this when you click Uninstall, choose NO:



Type msconfig in the search field and hit enter. A window will pop-up:


Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.

  • Remember this step – if you have reason to believe a bigger threat (like ransomware) is on your PC, check everything here.

Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.


Type Regedit in the windows search field and press Enter.

Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!

We just mentioned above that Trojans are the favorite tools of the cybercriminals and the reason for that is their ability to perform various harmful tasks. Practically, a virus such as Cobalt can be programmed for a wide range of malicious actions, some of which we already mentioned in the very first paragraph. This ability of the Trojans makes them very unpredictable and difficult to handle, since you never know what kind of harm you should expect. Another feature, which is helping this type of malware succeed in its criminal actions, is its stealthy methods of infection. Oftentimes, the victims are tricked in such a sophisticated way, that they are completely clueless about the ongoing infection and the presence of the malware for weeks or even months ahead. Usually, the hackers camouflage the danger as a harmless-looking file, an image, an interesting link or some email attachment. They spread it via social shares, torrents, spam email messages, software installers and various web pages. When the users come across the well-hidden Trojan, they often are not able to recognize it and carelessly click on it. A reputed antivirus program may be very helpful in this moment because, if regularly updated to the latest virus definitions, it may effectively recognize the danger. However, if the system has vulnerabilities and the protection is not reliable, any sophisticated virus such as Cobalt can easily get inside the computer. From then on, various harmful activities may be activated.

How can you remove Cobalt effectively?

Unfortunately, dealing with a Trojan horse can be challenging. Users, who are not familiar with malware removal are usually advised to use a professional removal tool (just like the one available below) or to contact a professional, who can remove the infection with all of its hidden scripts. Those of you, who want to try to remove Cobalt manually, may find the instructions in the Removal Guide below very helpful. They are detailed enough to guide you through the system, but still, it is very important how strictly you follow the steps and what kind of files you delete at the end. Make sure you correctly identify the Trojan-related files and not delete something else, which could be essential for the functionality of your operating system.


Name Cobalt
Type Trojan
Danger Level High (Trojans are often used as a backdoor for Ransomware)
Symptoms This threat usually tries to hide deep in the system and lacks any visible symptoms.
Distribution Method Social media shares, torrents, spam email messages, software installers and various sketchy web pages.
Detection Tool

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
More information about SpyHunter and steps to uninstall.

Leave a Comment