MoonBounce Malware


MoonBounce is one of the many viruses which belong to the Trojan horse virus category. MoonBounce is very stealthy and can be distributed by getting attached to spam emails, fake ads, malicious links, and cracked software.


Since MoonBounce is a new threat of a category of malware known for its versatility in the ways its representatives can be used, we can’t tell you the exact mission of this threat, or the exact type of damage it may cause to your system. However, don’t panic if you have MoonBounce in your system, as we have prepared a removal guide below to assist you with removing the infection from your system quickly, and reliably. But before you scroll down, please, read on the information that follows, so that you can get a clearer concept of what precisely you are up against, and how to prevent similar attacks in the future.

As pointed out, due to its multi-functional nature and stealth, the Trojan horse is a favorite tool of choice for many cyber criminals. Such malware can hide in various web locations, and contaminate you without any visible indications. In most cases, the harmful code can come along with a spam message, a malicious attachment, a fake ad, or a link that you are prompted to click on.

Once you interact with the transmitter, the infection will automatically take place, and the Trojan would get down to business. A piece of malware like MoonBounce, Msedge.exe, Msedgewebview2.exe can, for instance, be used for system and data corruption. However, in most cases, the Trojan will have a more precise mission. For instance, it may often be used to secretly launch different malicious processes like keylogging in order to collect important details such as bank account passwords, credit and debit card numbers, login credentials, etc. Obviously, these last ones can be used to steal your access to some platform, or even your money. Also, your private information can be sold on the black market for other hackers to use. 

Other popular uses may be related to espionage. A Trojan can monitor your screen, and remotely record you through you webcam, and computer microphone. There have been documented instances of when hackers have used their victims’ webcam of to inspect his or her home’s layout, and determine potential entry points, valuables, etc. A burglary would follow after enough data has been collected, and could be performed almost flawlessly.

Another way to use an infection like MoonBounce is to transform your computer into a bot, and use its resources for different reasons. For instance, the machine can be used to distribute viruses, and malware like Ransomware, and/or send spam to other computers. It could also be used to mine cryptocurrencies, and you’re not even going to know about it.

Therefore, it is best to take actions, and remove MoonBounce from your computer without losing time, or waiting for its malicious activities to damage your device completely. The removal guide below can certainly assist you with that, but you should also scan the system with reliable security software for optimal results.


Danger Level High (Trojans are often used as a backdoor for Ransomware)
Detection Tool

Remove MoonBounce Malware

If you have a Windows virus, continue with the guide below.

If you have a Mac virus, please use our How to remove Ads on Mac guide.

If you have an Android virus, please use our Android Malware Removal guide.

If you have an iPhone virus, please use our iPhone Virus Removal guide


Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).



Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab. Try to determine which processes are dangerous. 


Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
This scanner is free and will always remain free for our website's users.
This file is not matched with any known malware in the database. You can either do a full real-time scan of the file or skip it to upload a new file. Doing a full scan with 64 antivirus programs can take up to 3-4 minutes per file.
Drag and Drop File Here To Scan
Drag and Drop File Here To Scan
Analyzing 0 s
Each file will be scanned with up to 64 antivirus programs to ensure maximum accuracy
    This scanner is based on VirusTotal's API. By submitting data to it, you agree to their Terms of Service and Privacy Policy, and to the sharing of your sample submission with the security community. Please do not submit files with personal information if you do not want them to be shared.

    After you open their folder, end the processes that are infected, then delete their folders. 

    Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 



    Hold together the Start Key and R. Type appwiz.cpl –> OK.



    You are now in the Control Panel. Look for suspicious entries. Uninstall it/them. If you see a screen like this when you click Uninstall, choose NO:





    Type msconfig in the search field and hit enter. A window will pop-up:



    Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.

    • Remember this step – if you have reason to believe a bigger threat (like ransomware) is on your PC, check everything here.

    Hold the Start Key and R –  copy + paste the following and click OK:

    notepad %windir%/system32/Drivers/etc/hosts

    A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

    hosts_opt (1)


    If there are suspicious IPs below “Localhost” – write to us in the comments.



    Type Regedit in the windows search field and press Enter.

    Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

    • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
      HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
      HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

    If the guide doesn’t help, download the anti-virus program we recommended or try our free online virus scanner. Also, you can always ask us in the comments for help!


    About the author


    Violet George

    Violet is an active writer with a passion for all things cyber security. She enjoys helping victims of computer virus infections remove them and successfully deal with the aftermath of the attacks. But most importantly, Violet makes it her priority to spend time educating people on privacy issues and maintaining the safety of their computers. It is her firm belief that by spreading this information, she can empower web users to effectively protect their personal data and their devices from hackers and cybercriminals.

    Leave a Comment

    We are here to help! Use SpyHunter to remove malware in under 15 minutes.

    Not Your OS? Download for Windows® and Mac®.

    * See Free Trial offer details and alternative Free offer here.

    ** SpyHunter Pro receives additional removal definitions and manual fixes through its HelpDesk in cases where they are needed.

    Spyware Helpdesk 1