How to remove “BScope.Trojan.Kolovorot”?

The BScope.Trojan.Kolovorot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What BScope.Trojan.Kolovorot virus can do?

Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine BScope.Trojan.Kolovorot?


File Info:
name: 78470333271F5A8A9C4D.mlw
path: /opt/CAPEv2/storage/binaries/4369932bf2f0bb760b1ec78310aa11e247ca2cf9eae9c5f6c38a08664e572de3
crc32: 46695F50
md5: 78470333271f5a8a9c4d98e1bb0ec0d1
sha1: c5301f06b3ace6810df02b61a1dc1f75a6d5e858
sha256: 4369932bf2f0bb760b1ec78310aa11e247ca2cf9eae9c5f6c38a08664e572de3
sha512: 048255e9521d79a291f80810ada4f8f332bfd16ac45d45f1acb577111c1f1f61984999cd91168c69f4106eb672928041989f0295abafbe68e8820ebf718ace93
ssdeep: 24576:/vGMkKCmyt2aJAPoAjO4zSqPLbi9JgUqUbkI/I6/gGonQ/QsHFQ:/dNkAQPh7bonQ/QyFQ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T170658D01F762C8F1D126227480F6577295708D6A0A25DBDBF358FD59BF33291882FA2B
sha3_384: 37b50a9b2769bbb8305d1f7a853ee2630c028fdfe3badf3114e0e61bfbd3ca4b3ed58648e9641b4e2bb167364ffdf4c8
ep_bytes: 558bec6aff68d0895200681425470064
timestamp: 2012-04-21 17:45:44

Version Info:
0: [No Data]

BScope.Trojan.Kolovorot also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
DrWeb	Trojan.Click2.61116
ClamAV	Win.Malware.Zusy-6717397-0
FireEye	Generic.mg.78470333271f5a8a
Malwarebytes	Generic.Malware.AI.DDS
K7AntiVirus	Trojan ( 005246d51 )
K7GW	Trojan ( 005246d51 )
CrowdStrike	win/malicious_confidence_70% (D)
BitDefenderTheta	Gen:NN.ZexaCO.36662.CrW@aKflZKob
Cyren	W32/FlyStudio.E.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Cynet	Malicious (score: 100)
F-Secure	Trojan.TR/Agent.10752.DP
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Trapmine	malicious.moderate.ml.score
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
GData	Win32.Application.PSE.1THOGOA
Avira	TR/Agent.10752.DP
Antiy-AVL	Trojan/Win32.FlyStudio.a
Xcitium	Worm.Win32.Dropper.RA@1qraug
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
VBA32	BScope.Trojan.Kolovorot
Cylance	unsafe
Rising	Backdoor.Farfli!1.6542 (CLASSIC)
Ikarus	Trojan-Dropper.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.PHP!tr
Cybereason	malicious.6b3ace
DeepInstinct	MALICIOUS

How to remove BScope.Trojan.Kolovorot?

BScope.Trojan.Kolovorot removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X