Monitor.Win32.ZFKeyMonitor.a removal

The Monitor.Win32.ZFKeyMonitor.a is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Monitor.Win32.ZFKeyMonitor.a virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Monitor.Win32.ZFKeyMonitor.a?


File Info:
name: 208374709ECD2FE8ECAD.mlw
path: /opt/CAPEv2/storage/binaries/1ebe95eca25d44ba06f66308aefa9faf0b24596622f2bfdf5db20ccf5eeb51fe
crc32: 168E37FC
md5: 208374709ecd2fe8ecadbbf40685b959
sha1: 5f81880be021cbd73f8394498ce71d88f10c3cfd
sha256: 1ebe95eca25d44ba06f66308aefa9faf0b24596622f2bfdf5db20ccf5eeb51fe
sha512: 3fdf6effc0e037660a9ec9e29562ffc0e01c51366ccb28946ebf01c4164bccc53ca78d5ef352291ca06d4525f7062b21b3299f1e1caea09e59b5661bb67088dd
ssdeep: 98304:8BRXvTFIXr7uR3AHEOoRbh7P9cNED/1di5jJMV3UqDbHTnwfjd0d:8BRXvTFI77LCbh7VcNEDyYV3rDPnwxE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FA16336871F4FC2BEC2B487B9AB3A93D4F547734C4D2832B2918E23A6D4394BD8541D6
sha3_384: 96dcde535a083793e72c6df5f3007cff914300cc3764972966e29ddcbb864ef140417119bb2b3fe94fa1812dce16c299
ep_bytes: 81ec8001000053555633db57895c2418
timestamp: 2015-12-11 07:12:39

Version Info:
Comments: 地纬SDSESClientXCP
CompanyName: 山大地纬软件股份有限公司
FileDescription: 地纬SDSESClientXCP
FileVersion: 2.0.1803.71
InternalName: phoebus浏览器
LegalCopyright: 山大地纬软件股份有限公司 版权所有 (C)
LegalTrademarks: dareway
ProductName: SDSESClientXCP
ProductVersion: 2.0.1803.71
Translation: 0x0000 0x03a8

Monitor.Win32.ZFKeyMonitor.a also known as:

Bkav	W32.AIDetectMalware
Lionic	Riskware.Win32.ZFKeyMonitor.1!c
DrWeb	Program.Monitor.2918
Zillya	Tool.ZFKeyMonitor.Win32.21
Alibaba	RiskWare:Win32/ZFKeyMonitor.a62d593c
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	not-a-virus:Monitor.Win32.ZFKeyMonitor.a
NANO-Antivirus	Riskware.Win32.ZFKeyMonitor.eqzqod
Avast	Win32:Malware-gen
ZoneAlarm	not-a-virus:Monitor.Win32.ZFKeyMonitor.a
VBA32	Win32.Malware.Dropper.Heur
Yandex	Trojan.GenAsa!O5D4p6An17k
Fortinet	Riskware/ZFKeyMonitor
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS
CrowdStrike	win/grayware_confidence_90% (D)

How to remove Monitor.Win32.ZFKeyMonitor.a?

Monitor.Win32.ZFKeyMonitor.a removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X