NukeBot Removal (September 2018 Update)

This page aims to help you remove NukeBot. Our removal instructions work for every version of Windows.

In the following text you are going to learn some very important details about NukeBot and the possible problems, which may result from an infection with such a virus. Furthermore, we have attached a special Removal Guide especially designed to get rid of this Trojan program.

What type of software is NukeBot precisely?

According to the popular classification, NukeBot is an ideal example of the Trojan horse virus family. When we discuss computing and programming, a Trojan horse is the term that represents any malicious program, which can be used for entering your system (and often – even sneaking another virus (Ransomware) into it). Such an infection may be so subtle and more or less invisible that it might easily mislead you when it comes to its real intentions and goals. Precisely speaking, there are a lot of different Trojans. What puts them into one and the same software category is the fact that, typically, they are used by cyber terrorists for attacks on computers, performed in a stealthy way. Indeed, this is where their name really comes from: as they secretly infect their victim users without any visible signs of any danger. One more essential fact that you should be aware of is that the majority of the infections with malware are the ones caused by Trojans.

NukeBot can be found inside:

In general, there is no one concrete place, where such a malicious program like this may be lurking. More precisely, there are lots of diverse methods NukeBot might implement to invade your PC. Normally, the contamination takes place when you happen to come across one of these sources: malicious online ads; contagious letters and their corresponding attachments you often receive via email; or websites that spread shareware; torrents or illegally distributed software/ videos/ movies. Usually, NukeBot can efficiently use the weak spots of any program, installed on your PC, or the ones of the OS you use. For example, such a weakness might be the absence of an anti-virus program. Remember that our best and most effective Cyber Security Piece of Advice so far is:

*It is normally better to pay for the license of a great-quality anti-malware tool than to pay for saving your PC from viruses after it has already been infected.

NukeBot Removal


Some of the steps will likely require you to exit the page. Bookmark it for later reference.

Reboot in Safe Mode (use this guide if you don’t know how to do it).



Press CTRL + SHIFT + ESC at the same time and go to the Processes Tab. Try to determine which processes are dangerous. 


Right click on each of them and select Open File Location. Then scan the files with our free online virus scanner:

Drag and Drop Files Here to Scan
Maximum file size: 128MB.

This scanner is free and will always remain free for our website's users. You can find its full-page version at:

Scan Results

Virus Scanner Result

After you open their folder, end the processes that are infected, then delete their folders. 

Note: If you are sure something is part of the infection – delete it, even if the scanner doesn’t flag it. No anti-virus program can detect all infections. 


Hold together the Start Key and R. Type appwiz.cpl –> OK.


You are now in the Control Panel. Look for suspicious entries. Uninstall it/them. If you see a screen like this when you click Uninstallchoose NO:



Type msconfig in the search field and hit enter. A window will pop-up:


Startup —> Uncheck entries that have “Unknown” as Manufacturer or otherwise look suspicious.

  • Remember this step – if you have reason to believe a bigger threat (like ransomware) is on your PC, check everything here.

Hold the Start Key and R –  copy + paste the following and click OK:

notepad %windir%/system32/Drivers/etc/hosts

A new file will open. If you are hacked, there will be a bunch of other IPs connected to you at the bottom. Look at the image below:

hosts_opt (1)

If there are suspicious IPs below “Localhost” – write to us in the comments.


Type Regedit in the windows search field and press Enter.

Once inside, press CTRL and F together and type the virus’s Name. Right click and delete any entries you find with a similar name. If they don’t show up this way, go manually to these directories and delete/uninstall them:

  • HKEY_CURRENT_USER—-Software—–Random Directory. It could be any one of them – ask us if you can’t discern which ones are malicious.
    HKEY_CURRENT_USER—-Software—Microsoft—-Windows—CurrentVersion—Run– Random
    HKEY_CURRENT_USER—-Software—Microsoft—Internet Explorer—-Main—- Random

If the guide didn’t help you, download the anti-virus program we recommended or ask us in the comments for guidance!

What characterizes NukeBot? What can this Trojan be used for?

Trojans could have many different purposes. Still, we are unable to discuss them all in only one article, and that’s why we are just going to mention only the most usual ones. However, always remember that these ones might not be the only ones and your scenario might not be one of the discussed below. All Trojans, including NukeBot, can be used for:

  1. Stealing: personal or classified info, social media account or banking details: all of these could be the target of cyber criminals. This kind of virus might have been set to copy everything that you enter into your system.
  2. Abuse (such as spying on you): such viruses are really capable of rendering you a moving target. They might enable their developers to see what you do online all the time; where your address is; where your workplace is; what your interests and hobbies really are. Perhaps this is one of the worst ways in which Trojans could be used.
  3. Simple destruction: NukeBot might serve the aim of crashing your system or destroying some data stored there. Apparently, this is the way some of the hackers like to have fun without any real demands and further intentions, simply by practicing the probable ways of destroying something.
  4. Aiding a Ransomware virus get into your PC: You should be careful as this case occurs quite often. NukeBot could be used for finding a vulnerability in your programs or the operating system in general and helping a Ransomware-type program invade it. Once more, this is really one of the worst scenarios – to get infected by two malicious programs simultaneously. One of them (the Trojan) with quite unclear usages and purpose, and the other (the Ransomware): with the purpose to encrypt some important data and request a ransom in exchange for it.
  5. Exploiting your system resources: NukeBot might be programmed to make your computer act as a bot – for the aim of spreading spam, for example, or mining crypto currencies

How to remove a program like NukeBot?

We are glad to tell you that we may have come up with the best solution for your problem. Just continue reading and check out our Removal Guide. If you feel unsure about dealing with system files and fear you might delete the wrong thing, feel free to also use our professional removal tool, which will do the job for you.


Name NukeBot
Type Trojan
Danger Level  High (Trojans are often used as a backdoor for Ransomware)
Symptoms  Nothing really suspicious, depending on what the purpose of this virus really is.
Distribution Method  Via fake pop-ups, contagious requests, spam, attachments, streaming web pages, etc.
Detection Tool

Keep in mind, SpyHunter’s malware detection tool is free. To remove the infection, you’ll need to purchase the full version.
More information about SpyHunter and steps to uninstall.

Leave a Comment