How to remove Aria-body RAT: Full guide

Category: Trojan Damage: Severe Data added: September 23, 2021

Aria-body RAT is a malicious program that is part of trojan viruses. The purpose of Aria-body RAT is to steal users' data. The spread of this trojan often occurs through spam emails and fake updates.

What is Aria-body RAT?

Aria-body RAT hijacks web browsers, where it changes the display of information. The logins and passwords entered are stolen and sent to the fraudsters' remote server. By stealing logins and passwords, cybercriminals can quickly take over users' electronic accounts and transfer money to their wallets.

Cybercriminals use this feature to make users pay a ransom. Additionally, the trojan steals saved passwords, autocomplete, and other types of information. Aria-body RAT also contributes to recording data related to browsing the Internet (history, cookies, and more) and PC system data.

This malware should be destroyed because Aria-body RAT can mask itself perfectly in the PC system.

Name Aria-body RAT
Type Trojan
Damage Severe
Alternative Name Aria-body RAT
Detection Names Avast (Win32:Malware-gen), BitDefender (Gen:Variant.Johnnie.221509), ESET-NOD32 (A Variant Of Win32/Agent.ABXE), Kaspersky (HEUR:Trojan.Win32.Generic)
Symptoms Trojans are designed to stealthily infiltrate the victim's computer and remain silent, and thus no particular symptoms are clearly visible on an infected machine.
Distribution Methods Infected email attachments, malicious online advertisements, social engineering, software 'cracks'.
Attack Consequences Stolen passwords and banking information, identity theft, the victim's computer added to a botnet.

Aria-body RAT symptoms

Aria-body RAT can masquerade as a safe process and is difficult to find. However, the PC system begins to show itself with characteristic common symptoms, such as:

  • The processor consumes more of the computer's system resources.
  • The PC often hangs and crashes.
  • Browsers are flooded with malicious pop-ups.
  • Random windows start working on their own, with no action on the user's part.
  • Pages in the browser redirect the user to rogue sites.

How did Aria-body RAT get on my PC?

Aria-body RAT is spread via spam and fake updates. Spam is a variety of malicious attachments (PDF files, MS Office documents, and more). The user executes prescribed scripts by going to such extensions, and they secretly download and install the trojan.

Fake update programs start infecting the system by applying bugs and flaws in outdated software.

The main methods for viruses to appear:

  • A program with a virus is downloaded and installed on the PC (free programs often come bundled with Aria-body RAT).
  • An infected email is opened.
  • The user clicked on a pop-up ad.
  • Peer-to-peer networks.

The trojan program starts a chain reaction, additionally installing other viruses.

Aria-body RAT: legitimate or fake?

When a user notices a Aria-body RAT file, he can check whether it is legitimate or fake in two ways.

  • File location. The standard file is located in the C:\Windows\System32 folder. All other files with Aria-body RAT in their title are placed in different folders but not in the C:Windows\System32 folder.
  • Task Manager. First, start Task Manager - go to 'Processes' and look for Aria-body RAT.exe - right-click on it to remove it - if Windows shows a warning message, then Aria-body RAT.exe is a good process and doesn't need to be removed. Otherwise, when a warning appears, the Aria-body RAT.exe process is fake.

Remove the Aria-body RAT from your system

It happens very often that the user notices that the trojan program remains in the system after removal. This scenario may be since the registry with the rest of the PC system files are infected. Let's try to remove Aria-body RAT from the computer:

Method 1: Remove Aria-body RAT with AVarmor

AVarmor is a tool that removes malware. The utility helps users remove trojans like Aria-body RAT and various malware from their computers. The utility has a simple and user-friendly interface, as well as powerful mechanisms to protect your entire PC system.

  1. Download and install AVarmor.
  2. After completing the download process, run the tool, agreeing with its settings. Before that, you should close all extraneous programs on your PC.
  3. The utility will start its work, and the user needs to click the 'Scan' button for malware.
  4. Once the scan is complete, a list of dangerous objects found will be generated.
  5. Remove all of the threats found.
  6. Once the cleanup is finished, restart your PC.

Method 2: Removal via Registry Editor

Those who want to try removing Aria-body RAT manual use Regedit because the trojan can modify the registry itself.

  1. Let's run the command line.
  2. Enter Regedit at the prompt.
  3. Before uninstalling, it is necessary to make a backup copy of the registry (File - Export - save registry to a safe place).
  4. Once the backup copy is created, press Edit - Find.
  5. Enter Aria-body RAT.exe - Find next.
  6. Registry found? Right-click on it and click Delete.

Method 3: Connect your computer to the network and enter Safe Mode

First, try to boot your computer in safe mode. It would help if you did this to prevent Aria-body RAT from starting.

Windows 7, 10, Vista, XP

  1. First, carry out a restart of the computer.
  2. Press F8 Before you see Windows.
  3. You will see a menu of advanced options.
  4. Go to 'Safe Mode with Networking.'
  5. Press Enter.

Windows 8, Windows 8.1

  1. Press Windows+R to bring up the RUN window.
  2. Enter the command msconfig.
  3. Click OK.
  4. Click on the Boot tab.
  5. In that area, select the Safe Boot and Networking options.
  6. Click OK.
  7. Reboot the computer.

Method 4: Remove all questionable apps

The culprit application may remain even after trying to uninstall it, finding new locations in the PC system. Try to locate them:

  1. Right-click on the taskbar.
  2. Select Task Manager.
  3. Look through all the applications that consume system memory.
  4. Locate applications that have not been installed and run by the user.
  5. Right-click on them to open their location.
  6. Now open the Control Panel.
  7. Click Uninstall a program.
  8. Check for suspicious applications.

Method 5: Delete temporary files

The temporary files folder is the place where malicious files can be stored. Try deleting temporary files and folders:

  1. Open the Run window
  2. Enter the command %temp% and press Enter.
  3. The path C:\Users\[username]\AppData\Local\Temp will appear; that is, the temp folder will open.
  4. Delete the files and folders, and then empty the Recycle Bin.

Method 6: Remove Aria-body RAT from browsers

Now let's look at how to remove Aria-body RAT in the most popular browsers.

Mozilla Firefox

Dangerous extensions need to be uninstalled:

  1. Open Mozilla Firefox and click on Menu.
  2. Go to Add-ons.
  3. Choose Aria-body RAT and click on Remove.

Reset the homepage

  1. Click on the three horizontal lines at the top right of the screen to open the Menu.
  2. Go to Preferences.
  3. In this area, select your preferred home page.

Clear the cookies with the site data

  1. We go to the Menu, where we select Preferences.
  2. Now we need the Privacy and Security section.
  3. Find the Cookies and Site Data section.
  4. Click on Clear Site Data.
  5. Restart Firefox.

Reset Settings

  1. Open Firefox.
  2. In the upper right corner, click on the Menu to go to Help.
  3. Now select Troubleshooting Information.
  4. A new window will appear where you need to click on Refresh Firefox.
  5. Confirm the action.

Google Chrome

Dangerous extensions need to be uninstalled:

  1. Open Chrome.
  2. Click on Menu to select More Tools.
  3. Then go to Extensions.
  4. A new window will appear with all installed extensions.
  5. Uninstall the suspicious plugin related to Aria-body RAT.

Clear the cookies with the site data

  1. Go to the Menu and click on Settings.
  2. Go to Privacy & Security to select Clear browsing data (Browsing history, Cookies, cached images/files).
  3. Click on Clear data.

Reset the homepage

  1. Go to the Menu to select Settings.
  2. Look for a suspicious site that is in the On Launch section.
  3. Click Open a specific or set of pages, find Delete.
  4. Reload the browser.

Reset Settings

  1. Go to Menu to select Settings.
  2. Navigate to Advanced.
  3. Go to Reset & Clear.
  4. Click Restore Defaults.

Internet Explorer

Dangerous extensions need to be uninstalled:

  1. Select the 'gear' sign of Internet Explorer on the right side of the screen.
  2. Go to 'Manage extensions'.
  3. Look at all the recently installed suspicious extensions; among them is Aria-body RAT.
  4. Choose it and delete it.

Reset Settings

  1. Click Internet Explorer to open the browser.
  2. Click the gear icon to select Internet Settings.
  3. A new window will appear where we need the Advanced tab.
  4. Now click on Reset.
  5. Confirm your actions.

Microsoft Edge

Dangerous extensions need to be uninstalled:

  1. Select Menu.
  2. Find Extensions.
  3. In the list, select an extension, click the gear sign, where you choose Uninstall.
  4. Find the Trojan and uninstall it.

Clear the cookies with the site data

  1. We go to the Menu, where we select Privacy and Security.
  2. Now we need the Clear Browser Data section to select the categories that we want to clear.

Reset the homepage

  1. Click on the menu icon to go to Settings.
  2. Locate the On startup section.
  3. Click Disable on the suspect domain.

Reset Settings

  1. Press Ctrl+Shift+Esc to open the Task Manager.
  2. Click on Details.
  3. Go to the bottom of the page, where you need to find every entry named Microsoft Edge. Right-click on each of them and select End Task.


Dangerous extensions need to be uninstalled:

  1. Click the Safari sign.
  2. Go to Preferences...
  3. A new window will appear where you need to select Extensions.
  4. Select the unwanted extension and click Uninstall.

Clear the cookies with the site data

  1. Click on the Safari sign and select Clear history...
  2. A dropdown menu will appear under Clear, where you have to select all the history.
  3. Confirm your selection.

Reset Settings

  1. Click on the Safari sign to select Settings...
  2. Click on the Advanced tab.
  3. Tick the Show Develop menu.
  4. Next, click Develop and select Empty Caches.

Bottom line

We all know that the Internet continues to evolve rapidly, becoming more extensive. Every user should not forget to protect their system from viruses like Aria-body RAT.

We all know that the Internet continues to evolve rapidly, becoming more extensive. Every user should not forget to protect their system from viruses like Aria-body RAT.

This page is available in other languages: Deutsch | Español | Italiano | Français | Indonesia | Nederlands | Nynorsk | Português | Русский | Українська | Türkçe | Malay | Dansk | Polski | Română | Suomi | Svenska | Tiếng việt | Čeština | العربية | ไทย | 日本語 | 简体中文 | 한국어