The present invention discloses a remote control classification Trojan removing method and device, belonging to the network safety field. The method comprises: obtaining at least one data packet in network flow; matching at least one data packet according to the preset communication feature rule base, and obtaining a hitting data packet; and leading the flow of the hitting data packet to a remote control classification Trojan counter measure device. The remote control classification Trojan counter measure device builds and sends a self-destroy instruction through the flow injection and the controlled end of the remote control classification Trojan; and the remote control classification Trojan receives the self-destroy instruction and then executes the destroy. According to the technical scheme, the remote control classification Trojan removing method and device simulate the remote control classification Trojan master control end to build connection with the controlled end and send the self-destroy instruction to the controlled end so as to thoroughly destroy the Trojan program of the controlled end and improve the network safety.