PUA:Win32/Keypang removal tips

The PUA:Win32/Keypang is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUA:Win32/Keypang virus can do?

Behavioural detection: Executable code extraction – unpacking
Sample contains Overlay data
Presents an Authenticode digital signature
Authenticode signature is invalid

How to determine PUA:Win32/Keypang?


File Info:
name: D51382F93C180DEF6797.mlw
path: /opt/CAPEv2/storage/binaries/c1af66a7519a445c9b24a7336e0edc938cf9442b720f88e886321862cc4119b2
crc32: 3DC30722
md5: d51382f93c180def679726930113cef7
sha1: 72c3b7642ae881684f692626c69cc0441026190f
sha256: c1af66a7519a445c9b24a7336e0edc938cf9442b720f88e886321862cc4119b2
sha512: cbe814ff7acff73622c6a8b7cd5601ac01bc0d168834ee52ebdbb05cb51b3a32a5cc618a73c06e3c8cc1977b8ef343f8e6813a9c44697211dd7af29afb7b452a
ssdeep: 384:5EPOXbn0DT22XZ5KmjneJj4q41KYZUyNSsSM3oxoDsLOneJj4q41KYZUyNSs8KmO:XX+TlKfTM3QysLv1KDTyXhzSNP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16F735A0A7A09C4B1E14AC6B1CD63C0FA1E315E81EE618D5B3D19BFCF3D78AB5295920C
sha3_384: 4a331ec2a118f67618c23da527a3e7876cbb1e0aff57c51eb8739b4d4f571af42d14bc16d74ab424707479c8dd4906ca
ep_bytes: 68387b4000e8f0ffffff000000000000
timestamp: 2013-11-21 08:47:35

Version Info:
Translation: 0x0409 0x04b0
ProductName: adDll
FileVersion: 1.01
ProductVersion: 1.01
InternalName: kp
OriginalFilename: kp.exe

PUA:Win32/Keypang also known as:

Bkav	W32.Common.4235529C
Lionic	Trojan.Win32.Generic.4!c
DrWeb	Trojan.Adkor.324
MicroWorld-eScan	Trojan.GenericKD.68888516
FireEye	Trojan.GenericKD.68888516
ALYac	Trojan.GenericKD.68888516
Malwarebytes	Adware.Kraddare
Zillya	Adware.GraftorCRTD.Win32.3176
Sangfor	PUP.Win32.Agent.V9r9
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/grayware_confidence_90% (W)
Arcabit	Trojan.Generic.D41B27C4
VirIT	PUP.Win32.AD79.A
APEX	Malicious
BitDefender	Trojan.GenericKD.68888516
Avast	Win32:Malware-gen
Emsisoft	Trojan.GenericKD.68888516 (B)
F-Secure	Heuristic.HEUR/AGEN.1336007
VIPRE	Trojan.GenericKD.68888516
McAfee-GW-Edition	Artemis
Webroot	W32.Downloader.Gen
Avira	HEUR/AGEN.1336007
MAX	malware (ai score=84)
Microsoft	PUA:Win32/Keypang
GData	Trojan.GenericKD.68888516
Cynet	Malicious (score: 99)
McAfee	Artemis!D51382F93C18
Cylance	unsafe
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
DeepInstinct	MALICIOUS

How to remove PUA:Win32/Keypang?

PUA:Win32/Keypang removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X