Should I remove “MemScan:Trojan.PWS.ZKD (B)”?

The MemScan:Trojan.PWS.ZKD (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MemScan:Trojan.PWS.ZKD (B) virus can do?

The binary contains an unknown PE section name indicative of packing
The executable is compressed using UPX
Authenticode signature is invalid

How to determine MemScan:Trojan.PWS.ZKD (B)?


File Info:
name: 1B70F69183F362766B6F.mlw
path: /opt/CAPEv2/storage/binaries/322980a170347196701b7102d7ca16abdebf256f00e323d531840b5eaee90b48
crc32: 37BB0E34
md5: 1b70f69183f362766b6f634c94c73654
sha1: de9139a7e983b6e9f58e3246f1f0cbb0553014e2
sha256: 322980a170347196701b7102d7ca16abdebf256f00e323d531840b5eaee90b48
sha512: 1e271221b8acd90c61212bf9ced4955f3d6fcc3f986df9d9e7b50506807383edb684769f497a3020a44618a650eafc85c4e2318c4af2d9057aa0940335732fa6
ssdeep: 49152:vYFh3nnVaWHhhvUwZDWDGTTV1k/ydopKh7XVqx4njucZja9Z+:vmnVLdUMk/lxKucZja9Z+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F4C5AE31F1444476DED221B342ADB7726DADE72F032855CB57440BF6A620BC23A35BEA
sha3_384: 1a91178f92bd0de7257704e91b0f4ef885d7355da74be4ed04e0b9ea721db31e2f4ba6f6caeb704ad52d369eefd5e373
ep_bytes: 60be00b049008dbe0060f6ff5783cdff
timestamp: 2016-06-23 16:04:21

Version Info:
0: [No Data]

MemScan:Trojan.PWS.ZKD (B) also known as:

Bkav	W32.AIDetect.malware1
MicroWorld-eScan	MemScan:Trojan.PWS.ZKD
FireEye	MemScan:Trojan.PWS.ZKD
CAT-QuickHeal	W32.Ramnit.BA
ALYac	MemScan:Trojan.PWS.ZKD
Zillya	Virus.Nimnul.Win32.1
Sangfor	Trojan.Win32.Save.a
Baidu	Win32.Trojan.Kryptik.mx
Cyren	W32/Ramnit.B!Generic
Symantec	Trojan!im
APEX	Malicious
ClamAV	Win.Trojan.Ramnit-1847
BitDefender	MemScan:Trojan.PWS.ZKD
Avast	Win32:LokiBot-A [Trj]
Ad-Aware	MemScan:Trojan.PWS.ZKD
Sophos	Generic ML PUA (PUA)
Comodo	Virus.Win32.Ramnit.H@289q86
DrWeb	Trojan.PWS.Stealer.23680
VIPRE	Packed.Win32.PWSZbot.gen.cy (v)
TrendMicro	PE_RAMNIT.DEN
McAfee-GW-Edition	BehavesLike.Win32.Generic.vh
Emsisoft	MemScan:Trojan.PWS.ZKD (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Win32/IRCNite.wi
Avira	W32/Ramnit.C
MAX	malware (ai score=88)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
GData	MemScan:Trojan.PWS.ZKD
Cynet	Malicious (score: 100)
AhnLab-V3	Win32/Ramnit.J
McAfee	GenericRXGZ-RM!2AE3BDE8A48E
TrendMicro-HouseCall	PE_RAMNIT.DEN
Tencent	Virus.Win32.Nimnul.e
Ikarus	Trojan-Spy.Zbot
eGambit	Unsafe.AI_Score_97%
Fortinet	W32/Ramnit.A
BitDefenderTheta	AI:FileInfector.9425D5100E
AVG	Win32:LokiBot-A [Trj]
Cybereason	malicious.183f36
Panda	W32/Nimnul.A
MaxSecure	Trojan.Malware.300983.susgen

How to remove MemScan:Trojan.PWS.ZKD (B)?

MemScan:Trojan.PWS.ZKD (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X