How to remove “TrojanDownloader:Win32/Kuluoz!rfn”?

The TrojanDownloader:Win32/Kuluoz!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanDownloader:Win32/Kuluoz!rfn virus can do?

Injection (inter-process)
Creates RWX memory
Unconventionial language used in binary resources: Japanese
Anomalous binary characteristics

How to determine TrojanDownloader:Win32/Kuluoz!rfn?


File Info:
crc32: B28C76F9
md5: 2aa3b2e9b78cf1f3910232c7ebb039a4
name: 2AA3B2E9B78CF1F3910232C7EBB039A4.mlw
sha1: 5aafc0b9e7b231ad68df3223295f60e0ad60e970
sha256: e986197b427dda6b0c538e29e62ba382b00cfa909e6e5d9b9bc44b79ca35d5b6
sha512: ef35dfb60dd91c117c68e891762e8276a9d4072f943254ed85093bcdacfcda513f12279594f8718c9af7cc4b588f2b802c3d37f6fab97759ef43e3c259e22ea9
ssdeep: 3072:IW5WMzmx4ovkNcz8zZcxveT+PZhhIrbxKYBS8e:DW+mx4FHZcQ6hhhFN
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

TrojanDownloader:Win32/Kuluoz!rfn also known as:

DrWeb	Trojan.BrowseBan.2518
CAT-QuickHeal	Trojan.IGENERIC
ALYac	Trojan.Agent.CXHW
Cylance	Unsafe
Zillya	Downloader.DownloadHelper.Win32.3755
Sangfor	Trojan.Win32.Generic.8
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Trojan.Agent.CXHW
K7GW	Unwanted-Program ( 0051be3b1 )
K7AntiVirus	Unwanted-Program ( 0051be3b1 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/DllInject.DQ potentially unsafe
APEX	Malicious
Paloalto	generic.ml
Cynet	Malicious (score: 100)
NANO-Antivirus	Trojan.Win32.Agent.dyqjqb
MicroWorld-eScan	Trojan.Agent.CXHW
Tencent	Malware.Win32.Gencirc.10b4d4c9
Ad-Aware	Trojan.Agent.CXHW
Comodo	ApplicUnwnt@#yf25z7hgxhop
F-Secure	Trojan.TR/Dropper.Gen
BitDefenderTheta	Gen:NN.ZexaF.34608.juW@ay9B9fbG
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.cm
FireEye	Generic.mg.2aa3b2e9b78cf1f3
Emsisoft	Trojan.Agent.CXHW (B)
Jiangmin	TrojanSpy.Agent.yqe
Webroot	W32.Malware.Gen
Avira	TR/Dropper.Gen
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	TrojanDownloader:Win32/Kuluoz!rfn
Arcabit	Trojan.Agent.CXHW
AegisLab	Trojan.Win32.Agent.l!c
GData	Trojan.Agent.CXHW
AhnLab-V3	Malware/Win32.Generic.C1255635
McAfee	GenericRXAA-AA!2AA3B2E9B78C
MAX	malware (ai score=100)
VBA32	TrojanSpy.Agent
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TROJ_GEN.R066H0CBQ21
Rising	Dropper.Generic!8.35E (CLOUD)
Yandex	Trojan.GenAsa!KdPnCjSUSpQ
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Agent.CZLX!tr
Panda	Trj/GdSda.A

How to remove TrojanDownloader:Win32/Kuluoz!rfn?

TrojanDownloader:Win32/Kuluoz!rfn removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X