How to remove “Troj/Emotet-CLN”?

The Troj/Emotet-CLN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Troj/Emotet-CLN virus can do?

Executable code extraction
Creates RWX memory
Spoofs its process name and/or associated pathname to appear as a legitimate process
Network activity detected but not expressed in API logs

How to determine Troj/Emotet-CLN?


File Info:
crc32: 4DDDCD1E
md5: 8d39f83ad9a2527cdd3961130cd04d87
name: wEwD.exe
sha1: 16d1a6506fcab557bc483dc70eacbe81984608c9
sha256: 7309938ef60ffa255a9c2642b5a62c86b1e74b4a289162fd63567378b9232b3f
sha512: bfbc07f707b0d51f00ab499ba41eaebf78e53085911f9aba3cba9cc0eaf8699a376d0b0046ecd27fea08e49509232e3cb8ff0060a59b9ccd1bea04235ab17d6e
ssdeep: 1536:+jK9fyDVKIemjYYT0ENTZAo2+byBxoMq4sARCXDx2SJ0QX3HG84h:HfeVKIepYTmNqyPoMq4saCXs5CW84h
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2005
InternalName: SplitPath
FileVersion: 1, 1, 0, 0
CompanyName: 
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: Anwendung SplitPath
SpecialBuild: 
ProductVersion: 1, 1, 0, 0
FileDescription: MFC-Anwendung SplitPath
OriginalFilename: SplitPath.EXE
Translation: 0x0407 0x04b0

Troj/Emotet-CLN also known as:

Bkav	W32.AIDetectVM.malware2
MicroWorld-eScan	Trojan.GenericKDZ.69602
FireEye	Trojan.GenericKDZ.69602
CAT-QuickHeal	Trojan.CKGENERIC
ALYac	Trojan.GenericKDZ.69602
VIPRE	Trojan.Win32.Generic!BT
CrowdStrike	win/malicious_confidence_60% (W)
BitDefender	Trojan.GenericKDZ.69602
K7GW	Trojan ( 0056cfcb1 )
K7AntiVirus	Trojan ( 0056cfcb1 )
Cyren	W32/Emotet.AQR.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Packed.Generickdz-9481059-0
Kaspersky	Trojan-Banker.Win32.Emotet.gcei
Alibaba	Trojan:Win32/Emotet.9a3e4aa3
NANO-Antivirus	Trojan.Win32.Emotet.hrymch
Rising	Trojan.Kryptik!8.8 (TFE:5:5qY5YVS8bLV)
Ad-Aware	Trojan.GenericKDZ.69602
F-Secure	Trojan.TR/Crypt.Agent.nqaeh
DrWeb	Trojan.DownLoader34.26289
Zillya	Trojan.Emotet.Win32.24752
TrendMicro	TROJ_GEN.R002C0DHM20
MaxSecure	Trojan.Malware.105705874.susgen
Sophos	Troj/Emotet-CLN
Ikarus	Trojan-Banker.Emotet
Jiangmin	Backdoor.Emotet.sn
Avira	TR/Crypt.Agent.nqaeh
MAX	malware (ai score=83)
Antiy-AVL	Trojan/Win32.Kryptik
Microsoft	Trojan:Win32/Emotet.PED!MTB
Arcabit	Trojan.Generic.D10FE2
ZoneAlarm	Trojan-Banker.Win32.Emotet.gcei
GData	Trojan.GenericKDZ.69602
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Emotet.R348891
McAfee	RDN/Generic.grp
TACHYON	Backdoor/W32.Emotet.135262
VBA32	Trojan.Woreflint
Malwarebytes	Trojan.Agent
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/Kryptik.HFQQ
TrendMicro-HouseCall	TROJ_GEN.R002C0DHM20
Tencent	Malware.Win32.Gencirc.10cdeb65
Fortinet	W32/Kryptik.HCEJ!tr
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
Qihoo-360	Generic/Trojan.8ca

How to remove Troj/Emotet-CLN?

Troj/Emotet-CLN removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X