2.9.26
Released 2 Nov 2026
Official MatchFerry website
Remote Access Trojan Detection on Your Own Computer
MatchFerry 2.9.26 is an autonomous agent for Windows 10/11. It runs your own commands, saves the output and shows each result as a card, so you read the evidence about your computer yourself.
List my scheduled tasks and running processes, and mark anything that starts from AppData or Temp.
- Shell
schtasks /query > tasks.txtexit 0 - read_file
tasks.txtread - grep
AppData tasks.txt3 matches - Shell
tasklist > processes.txtexit 0 - grep
Temp processes.txt2 matches - write_file
startup-review.txtsaved
waiting for your OK before the next stepRejectAccept
34 MB
Setup program download
25 MB
Single exe file
13
App interface languages
3 types
Cloud, local, built-in
3 modes
Auto-run, Ask first, Plan only
Remote Access Trojan Detection You Can Read
Remote access trojan detection starts with evidence, not guesses. MatchFerry 2.9.26 runs your own Windows commands, saves what they print and shows every result as a card in the chat. You read the lists yourself and decide which items need a second look. Nothing here proves an infection.
Check connections to detect remote access trojan signs
Start with the network. Shell runs netstat -ano, which lists the connections of this computer together with the process ID that owns each one, and the output is saved to a text file. Then read_file opens that file and grep keeps the lines you want to inspect, such as established connections to addresses you do not recognise. You judge which connections look odd, because an unfamiliar address is only a lead and never proof. In Ask first mode MatchFerry pauses before it writes your notes, and the diff shows exactly what will be saved on Windows 10/11.
Tool trace
Shell netstat -ano > connections.txt → exit 0
read_file connections.txt → read
grep ESTABLISHED connections.txt → 4 matchesReview scheduled tasks and startup entries
Persistence is the way malware makes itself start again after a restart, so scheduled tasks deserve a look. Shell runs schtasks /query and saves the list, and grep searches it for paths inside AppData or Temp and for names you do not recognise. Watch for new tasks. The list covers scheduled tasks only, not every startup entry, so you also open the Startup folder and Task Manager yourself. write_file stores a findings note with one line per item, and in Ask first mode you read its diff before you accept it on Windows 10/11.
Tool trace
Shell schtasks /query > tasks.txt → exit 0
grep AppData tasks.txt → 3 matches
write_file startup-review.txt → savedCheck a suspicious file without running it
Do not open it. Shell runs certutil -hashfile with SHA256, which prints the SHA-256 hash of the file, and you also look at its folder, its name and the digital signature in the file properties. web_search then looks for that hash or file name in public sources to see whether other people report it. A report is a lead to check, not proof, and your antivirus can raise a false alarm on a harmless file as well. write_file keeps the hash and your notes together, and you review the finished note before you rely on it.
Turn a screenshot into searchable text
Screenshots work too. When a window shows a table that cannot be copied, such as a list of installed programs, you save a screenshot and ocr reads the text from it. write_file stores the text next to your other notes, and grep can then search it for a name or a path. Because ocr can misread characters, compare the result with the original screenshot before you rely on it. Each step appears as a card, and in Ask first mode you accept the new file only after reading its diff, next to the 3 lists from the earlier checks.
How it differs from a typical chat assistant
The agent acts. In Ask first mode a diff appears before a change is accepted, and each result of MatchFerry 2.9.26 stays visible as a card in the chat.
| Typical chat assistant | MatchFerry | |
|---|---|---|
| Actions | Suggests commands for you to run | Runs the tools itself and shows each result |
| Output | Replies with text only | Shows the real command output or file diff in a card |
| Files | Works with text you paste in | Reads and writes files in the chat's working folder |
| Control | You copy and run each command yourself | You choose Auto-run, Ask first or Plan only |
How to get started
- Download the setup program of about 34 MB from this site and compare its SHA-256 checksum with the published manifest.
- Run the setup program on your Windows 10 or 11 computer. If SmartScreen warns, choose More info and Run anyway only after the checksum matches.
- Open MatchFerry, connect a model (a cloud provider, a local model or the built-in one) and choose a working folder.
- Describe what you want checked in the chat, pick Auto-run, Ask first or Plan only, and read the result cards.
Who uses it and when
Home users and beginners who are worried they might have a trojan are the first audience. MatchFerry shows every command and its real output as a card, so you learn what a process list or a connection list looks like on Windows 10/11. No account is needed. People who search for rat malware detection often start here.
Technical users who look after machines they are authorised to check use it as a checklist runner. Shell lists processes with tasklist, connections with netstat -ano and scheduled tasks with schtasks /query, and grep reads the saved files. Every card shows its command. Someone who accidentally installed a trojan from a download can review new startup entries the same way.
People who look after a relative's computer with that person's permission fit here as well. Permission comes first. MatchFerry 2.9.26 is meant only for computers you own or are authorised to check, and the setup program of about 34 MB runs on Windows 10/11 without an account.
Frequently asked questions
What is remote access trojan detection?
Remote access trojan detection is the checking of a computer for signs that someone controls it from a distance, such as odd processes, unexpected outgoing connections or new scheduled tasks. MatchFerry helps by running your own commands and organising the output into cards. You judge each sign yourself.
Is codemonkeycode.net the official MatchFerry website?
Yes, codemonkeycode.net is the official MatchFerry website. The download button gives the original 2.9.26 setup program of about 34 MB, and you can compare its SHA-256 checksum with the published manifest using certutil before you run it. Compare before you run. Problems can be reported with the Send feedback button in the app.
How to know if I have spyware on my computer?
Three signs are worth a first look: unfamiliar programs running from AppData or Temp, unexpected outgoing connections, and scheduled tasks you did not create. Each is a lead. In MatchFerry, Shell runs tasklist, netstat -ano and schtasks /query, and you read the saved lists as cards.
How to detect spyware on computer using an AI agent?
The agent runs your own commands through Shell, saves each output, reads the saved files with read_file and grep, and writes a findings note with write_file. Then you check the cards. In Ask first mode MatchFerry pauses before an action that changes something and shows the diff to accept.
What if my PC is infected with remote access malware?
The general steps are to disconnect the PC from the network, run a full scan with your own antivirus, change important passwords only from a different clean device, and back up personal files before a clean reinstall of Windows, the most thorough option. Disconnect first. MatchFerry only helps you collect the evidence.
Does MatchFerry remove malware?
No. MatchFerry gathers and organises evidence, it is not an antivirus, and it does not remove malware or decide that a PC is infected. Removal is a job for your own antivirus scan. Use the cards to decide what to look at next, and never stop or delete a file you cannot identify.
Does a clean result mean my computer is clean?
No. A clean result never proves that a PC is clean, because a list can only show what the commands report at that moment. Run your own antivirus scan as well. Treat every odd item as a lead to verify, and treat every normal-looking item as unproven rather than as cleared.
Start your first review
Download the 34 MB setup program, connect a model and ask for your first list. Every result appears as a card in the chat, and in Ask first mode you read a diff before anything changes. Begin with processes.
Download MatchFerry for Windows ↗More about MatchFerry
Every page of this website is available in 20 languages, while the app interface has 13.
What the agent can do for your review ↗ Cloud, local and built-in models ↗ Step-by-step checks for processes, connections and tasks ↗ Download and verify the setup program ↗ More questions answered ↗ What the website and the app collect ↗
