STX RAT is a remote access threat that drew attention after attackers abused trust in CPUID downloads. Rather than arriving in an obviously suspicious file, it rode in HWMonitor, a utility people use to watch temperatures, voltages, fan speeds, and PC health.
Between April 9 and April 10, 2026, altered links on the vendor’s site sent visitors to poisoned packages for CPU-Z and other utilities. These bundles mixed the real signed program with a rogue DLL, so launching the app started the infection chain.
Once active, similar to RenPy instaler virus and CrystalX RAT, the malware contacts a command server, loads extra components, and can hand criminals access that lasts. The operation has been linked to infrastructure from a fake FileZilla campaign, and STX RAT is associated with data theft and hidden desktop control.
We tested that SpyHunter successfully removes STX RAT* and we recommend using it. It will block STX RAT from reinstalling itself and it will make sure your device is clean from any malware.
Try Free For 7 Days*
Buy now15% OFF if you buy straight without trial.
OFFERAnyone who downloaded an affected tool during that short window should assume the device may be compromised. Cleanup can be more involved than it looks, so if the manual guide feels too difficult to follow, SpyHunter 5 is an option for removing the threat.
STX RAT Removal Guide
Begin with the shorter manual check below. It covers the most common places where STX RAT leaves an installed app or recently downloaded file. If those quick actions solve the problem, you can stop there. If not, continue to the full walkthrough for deeper checks.
Quick Manual Removal for STX RAT – Try This First
- 1.1First, go to your downloads folder (This PC > Downloads), sort the items there by date, and see if any suspicious files have been downloaded recently. Found anything fishy? Delete it before continuing.
- 1.2Next, go to the Start Menu, navigate to Settings (the gear icon), and then to Apps.
- 1.3You’ll see all installed programs listed on that page – sort them by installation date and look for STX RAT or anything else that looks suspicious, unfamiliar, or unwanted.
- 1.4If you find STX RAT or another sketchy app, select it and start the uninstallation process. Be careful when following the uninstallation prompts so that you don’t let anything linked to the program remain on your PC.
-
1.5Afterward, look for the installation directory. You’ll often find it at
C:\UserNames\UserName\AppData\Local\Programs\, but it might also be elsewhere. - 1.6If you find the malware folder, remove it together with any leftover files that might still be in it.
Restart the computer after the quick removal attempt and check whether the unwanted app still appears. If it does, that is common with threats that leave behind persistence items. The full guide below covers the extra checks usually needed to remove remaining components.
SUMMARY:
How to Fully Get Rid of STX RAT
The full cleanup starts with SpyHunter 5 because it can often remove STX RAT before you need the more technical manual steps. This scan is optional, but it is the fastest and least error-prone place to begin. If it clears the detections, you may be able to stop there.
Fastest Removal Option: Use SpyHunter 5
- 1.1Click here to download and install the anti-malware tool on your PC.
- 1.2
Start SpyHunter 5, click the Buy button and choose between starting your 7-days free trial or directly purchasing the tool.If you choose to buy SpyHunter 5 now, you can use our discount code, “HTRG15“, for 15% off.
- 1.3
Once you activate SpyHunter, click Start Scan Now, select the Full Scan option, and let the tool do its job. - 1.4
Once the scan completes (it could take a while, so have patience), you’ll see all malware and other undesirables listed.Click Next to review the detections and then click Next again to delete all rogue items.
Preparatory Steps for Removing STX RAT
If you would rather handle the cleanup yourself, start with these preparation steps for STX RAT. They make the rest of the guide easier by exposing hidden locations and adding a force-delete tool for files that stay locked by active processes. Doing this first usually saves time later.
1. Preparing for the STX RAT Removal
- 1.1
The first preparatory step you must perform is to enable the visibility of hidden files and folders.
Do this by searching for Folder Options in the Start Menu and selecting the View tab. Then activate “Show hidden files and folders” and save the change by clicking Apply and then OK. - 1.2Next, you’ll need to download and install a free utility called LockHunter It’s crucial because it lets you delete files locked by malicious processes.
We understand that some users prefer not to install extra utilities. In this case, though, LockHunter can help remove files connected to STX RAT that Windows refuses to delete because a hidden process, service, or permission issue is still keeping them in use.
The good part is that LockHunter is lightweight, free to use, and quick to set up. Once it is installed, you can use it later in the guide to remove stubborn STX RAT leftovers that do not go away through normal deletion.
Remove STX RAT Processes From the Task Manager
In Task Manager, do not expect the harmful process to always use an obvious name tied to STX RAT. Trojans often hide behind random labels or names that imitate legitimate software. Focus on unusual CPU or memory usage, strange file locations, and processes linked to programs you do not recognize.
2. How to Delete STX RAT Processes in the Task Manager
-
2.1This is done through the Task Manager which you can open by pressing
Ctrl + Shift + Esc. - 2.2If it shows a simplified view, click More Details to expand it and see all running processes.
- 2.3
Sort the list of processes by how much Memory or CPU they are using. Then look out for any that are using unusually large amounts of either resource type and yet don’t seem related to any legitimate programs that you have on your PC.Note: Don’t expect to find a rogue process named “STX RAT“. Most forms of malware will hide their processes under innocent-looking names.
- 2.4For each dubious process, right-click it and select Open file location. This will lead you to a folder where the data used by this process is stored.
- 2.5You must delete that entire folder, but you’ll likely get an error when you attempt to do that because some of the files there are in use by the malware. The workaround is to use LockHunter: right-click the folder, select “What’s locking this folder?” from the context menu, and click Delete in the next window.
- 2.6After removing the files, go back to Task Manager, write down the name of the rogue process (you’ll need it later), then click it, and click the End Task button to quit it.
Delete STX RAT Virus Files
After stopping suspicious processes, check the folders below carefully because STX RAT may leave helper files in several locations, not just one installation directory. Missing even a small leftover can let the threat restore settings or reappear later, so work through each path methodically and remove only items that clearly do not belong.
3. How to Get Rid of STX RAT Files
-
3.1Start by examining the Startup folders at:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartupC:\Users\*Your Username*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup -
3.2Search them for suspicious files, but if you aren’t what files are rogue, just delete everything in those folders except for the
desktop.inifile, which is a standard system file. -
3.3Next, inspect the
Program FilesandProgram Files (x86)in yourC:drive. Some malware apps will create folders there, so look for anything that looks linked to STX RAT or that is otherwise unrecognized or out-of-place folders. Delete anything suspicious you may find. -
3.4Three other locations you must check are:
C:\Users\%user%\AppData\Local\C:\Users\%user%\AppData\Local\Programs\C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\
Again, if you notice anything fishy in them, it must be deleted. And if there’s a folder you aren’t sure about, it’s probably best to get rid of it. At worst, it will be something harmless linked to a legitimate program in your system. However, if you didn’t recognize its name right away, chances are it’s something you either don’t need or something that’s outright unwanted (like STX RAT). -
3.5
Finally, remember to clear the Temp folder. It’s located atC:\Users\YourUsername\AppData\Local\Temp.
It stores only temporary files, which are all okay to delete. So, to save yourself some time spent looking for malware files, just Ctrl + A to select everything, and then press Delete from your keyboard to delete all of the folder’s contents.
Get Rid of STX RAT Scheduled Tasks
Task Scheduler is easy to overlook, but it matters because STX RAT may create tasks that reopen a malicious file at logon or after a delay. Even when visible files are removed, one hidden task can undo your progress. Review the listed entries slowly and delete only the ones tied to suspicious executables.
4. Eliminate STX RAT Scheduled Tasks
- 4.1
Open the Task Scheduler by searching for it in the Start Menu search bar. Then, one by one, review the scheduled tasks in the Task Scheduler Library. -
4.2For each task, double-click it and open the Actions tab, where you can learn what it is that the task is set to perform. Look for tasks that run unfamiliar executables, scripts, or anything located in the
AppDataorRoamingdirectories. - 4.3If you come across a task that executes anything suspicious, write down its file path, then right-click the task, and select Delete.
- 4.4After that, go to the file path you saved and delete the file that the task was set to run.
Uninstall the STX RAT Malware App Through the Windows Registry
The Registry check is important because STX RAT may leave entries that relaunch components, reconnect them to startup, or keep settings in place after reboot. At the same time, this step requires care, since deleting the wrong key can affect Windows or legitimate software. If you want a safer option, SpyHunter 5 can handle this part automatically.
5. Remove STX RAT Through the Registry
- 5.1Type “regedit” in the Start Menu and hit Enter to go to the Registry Editor.
- 5.2Then click Edit > Find to open the search box and then type the exact name of whatever program you tried to uninstall during the quick steps at the start of the guide.
- 5.3Click Find Next and if a result comes up, click the registry key (folder) in the left panel that contains it and delete that key. Perform another search after each deleted key until there are no more results for that search query.
- 5.4Next, search for the name of any other programs you attempted to delete. Also search for the names of processes you ended in the Task Manager earlier in the guide.
-
5.5After you’ve deleted all relevant entries, manually navigate to these registry keys:
HKCU\Software\Microsoft\Windows\CurrentVersion\RunHKCU\Software\Microsoft\Windows\CurrentVersion\RunOnceHKLM\Software\Microsoft\Windows\CurrentVersion\RunHKLM\Software\Microsoft\Windows\CurrentVersion\RunOnceHKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RunHKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RunHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnceHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\SetupHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services - 5.6Select each of these keys to reveal their contents in the right panel. Then look for values referencing STX RAT or any unknown applications. Delete only the specific values linked to the malware and leave the keys that contain them intact.
