Should I remove “Trojan.Downloader.WK”?

The Trojan.Downloader.WK is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Downloader.WK virus can do?

Performs HTTP requests potentially not found in PCAP.
Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Attempts to modify proxy settings
Deletes executed files from disk

How to determine Trojan.Downloader.WK?


File Info:
name: E470B7538DC075294532.mlw
path: /opt/CAPEv2/storage/binaries/019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e
crc32: 0897B6D3
md5: e470b7538dc075294532d8467b1516f8
sha1: 2549bd733c84677a4e145051f07d93434c8a555d
sha256: 019874898284935719dc74a6699fb822e20cdb8e3a96a7dc8ec4f625e3f1116e
sha512: ca448025e195275085566b0fe9c771be1ba2d257c1e6257f899a7b706fdca1f7b1e32154573f2883bf341bba0c3114c4c6411ebfd29ec528eb61929ad00ef371
ssdeep: 192:T6qhdbSbLCNmOWN4K0uof5CQEVH9Ol8H9B41oynAmDI98lR4oSdIZYRyODD7c+KN:esxmOWXDAvE2lw41lDI98MDL7QYq1N
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1448209476AD519F2FBA4863006FF07B76776609506B9A6936E20DC0D4C372A39B231CE
sha3_384: 746e7d91428c6b631315f60bca3457cd1fa3e543f61e750dae44a0a0860b536389bb28fb94be7ef3d7759e2f310b6f7d
ep_bytes: 558bec6aff68a835400068442e400064
timestamp: 2017-03-21 18:33:02

Version Info:
CompanyName: 
FileDescription: Microsoft MFC Application
FileVersion: 1, 0, 0, 1
InternalName: MMagicIII
LegalCopyright: Copyright (C) 2013
LegalTrademarks: 
OriginalFilename: MMagicIII.EXE
ProductName: MMagicIII Application
ProductVersion: 1, 0, 0, 1
Translation: 0x0409 0x04b0

Trojan.Downloader.WK also known as:

Bkav	W32.Common.5BC1011B
Lionic	Trojan.Win32.OnLineGames.lulb
DrWeb	Trojan.DownLoader24.49746
MicroWorld-eScan	Gen:Variant.Ulise.212095
FireEye	Gen:Variant.Ulise.212095
Skyhigh	Generic Trojan.fc
McAfee	Generic Trojan.fc
Malwarebytes	Trojan.Downloader.WK
VIPRE	Gen:Variant.Ulise.212095
Sangfor	Downloader.Win32.Demp.V9l9
K7AntiVirus	Riskware ( 0040eff71 )
Alibaba	TrojanDropper:Win32/Trayntadd.3a28d1c4
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_100% (W)
BitDefenderTheta	Gen:NN.ZexaF.36802.bq0@aSrKLcpi
VirIT	Trojan.Win32.Dnldr24.CVPI
Symantec	Downloader
Elastic	malicious (high confidence)
ESET-NOD32	Win32/TrojanDownloader.Small.AWT
TrendMicro-HouseCall	TROJ_DEMP.G
Cynet	Malicious (score: 99)
BitDefender	Gen:Variant.Ulise.212095
NANO-Antivirus	Trojan.Win32.Demp.felhrx
F-Secure	Trojan.TR/Dldr.Small.vezid
Zillya	Dropper.Demp.Win32.2474
TrendMicro	TROJ_DEMP.G
Sophos	Mal/Generic-R
Jiangmin	TrojanDropper.Demp.bnr
Avira	TR/Dldr.Small.vezid
MAX	malware (ai score=100)
Antiy-AVL	Trojan[APT]/Win32.Tick
Xcitium	Malware@#1umnibcn5k1jt
Arcabit	Trojan.Ulise.D33C7F
ViRobot	Dropper.S.Agent.17920.NO
ZoneAlarm	Trojan-Dropper.Win32.Demp.aswa
GData	Gen:Variant.Ulise.212095
Google	Detected
AhnLab-V3	Trojan/Win32.Homamdown.R230536
VBA32	TrojanDropper.Demp
ALYac	Trojan.Dropper.17920C
TACHYON	Trojan/W32.Dropper.17920
DeepInstinct	MALICIOUS
Cylance	unsafe
APEX	Malicious
Tencent	Malware.Win32.Gencirc.10bb9270
Yandex	Trojan.DownLoader!5DQYB5AuUNI
Ikarus	Trojan-Downloader.Win32.Small
MaxSecure	Trojan.Malware.10833744.susgen
Fortinet	W32/Demp.ASWA!tr
Cybereason	malicious.38dc07
Panda	Trj/CI.A
alibabacloud	Suspicious

How to remove Trojan.Downloader.WK?

Trojan.Downloader.WK removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X