Adware Reports malware removal guides and threat research Updated security instructions for Windows users
Home/Spy
Threat report

About “TrojanSpy:Win32/Nivdort.DA” infection

Published Nov 25, 2023 Spy category 3 min read
Report context

What to verify before removal

About “TrojanSpy:Win32/Nivdort.DA” infection deserves a credential-safety review because this spy label can overlap with remote access, browser data theft, or persistence after reboot. Cleanup should include scanning the file, removing the persistence point, and rotating exposed passwords from a clean device.

Start by comparing the local file name with E8D216371DE2B8C65575.mlw, then review the behavior notes for credential theft, browser data access, remote-control activity, and persistence after reboot. This helps separate a matching detection from a different file that only shares a similar alert name.

Observed file
E8D216371DE2B8C65575.mlw
  • Compare the suspicious file name with E8D216371DE2B8C65575.mlw.
  • Confirm the detection name matches About “TrojanSpy:Win32/Nivdort.DA” infection before removing related files.
  • Review the report for credential theft, browser data access, remote-control activity, and persistence after reboot so the cleanup is based on observed behavior, not only the label.
  • After cleanup, rotate passwords from a clean device and review browser sessions or saved credentials.

The TrojanSpy:Win32/Nivdort.DA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What TrojanSpy:Win32/Nivdort.DA virus can do?

  • Reads data out of its own binary image
  • Drops a binary and executes it
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Creates a copy of itself
  • Deletes executed files from disk

How to determine TrojanSpy:Win32/Nivdort.DA?



File Info:

name: E8D216371DE2B8C65575.mlw
path: /opt/CAPEv2/storage/binaries/00e4676cec3b0895e5e2716766fc36a9521220debada5f114a556ee1782016d1
crc32: 94C5D8D3
md5: e8d216371de2b8c65575aea83ac0a07c
sha1: 3eb0d0d9798e19e3d02e3f491da79ffd0d303549
sha256: 00e4676cec3b0895e5e2716766fc36a9521220debada5f114a556ee1782016d1
sha512: 0e60cfde02900f1e315046abbd165b26bc7fd3c275032de22f942e9548257339532c96952a7c42dda6704a6b04ed5aab357f5dd89552984d1a9ed879880e17d0
ssdeep: 6144:cwjMFnXQTTEVX9M+7OGSEefzE+ak4zqp:cwWQTTk7OGNefzEDkcw
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1D634BF27E6482127C91B727C4F1A7BE5A4BF71326621660D83EC29CC5CA17DDB63312B
sha3_384: cf5452ab628827916e8c7443777608108bcf9517d1a75258043aba87d79911aa74099b8cb7da7e41172bb5635fd52bd3
ep_bytes: 66a16add43000fbf0d56e343009803c8
timestamp: 2014-12-22 14:28:20


Version Info:

0: [No Data]

TrojanSpy:Win32/Nivdort.DA also known as:

Bkav W32.AIDetectMalware
MicroWorld-eScan Gen:Variant.Lazy.219050
FireEye Generic.mg.e8d216371de2b8c6
CAT-QuickHeal TrojanSpy.Nivdort.DR3
Skyhigh BehavesLike.Win32.Trojan.dc
McAfee Trojan-FHQT!E8D216371DE2
VIPRE Gen:Variant.Lazy.219050
Sangfor Suspicious.Win32.Save.a
K7AntiVirus Trojan ( 004dc2a31 )
K7GW Trojan ( 004dc2a31 )
Cybereason malicious.9798e1
Arcabit Trojan.Lazy.D357AA
Baidu Win32.Trojan.Generic.ay
Symantec Trojan.Bayrob!gen6
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Bayrob.BA
APEX Malicious
Cynet Malicious (score: 100)
Kaspersky HEUR:Trojan.Win32.Generic
BitDefender Gen:Variant.Lazy.219050
NANO-Antivirus Trojan.Win32.Nivdort.eabkyr
Avast Win32:Vupa [Cryp]
Sophos Mal/Bayrob-A
F-Secure Heuristic.HEUR/AGEN.1318579
DrWeb Trojan.DownLoader46.34512
TrendMicro TROJ_BAYROB.SM7
Trapmine malicious.high.ml.score
Emsisoft Gen:Variant.Lazy.219050 (B)
SentinelOne Static AI – Malicious PE
Jiangmin Trojan.Bayrob.itb
Webroot W32.Trojan.Gen
Google Detected
Avira HEUR/AGEN.1318579
MAX malware (ai score=83)
Antiy-AVL Trojan/Win32.TSGeneric
Kingsoft malware.kb.a.1000
Microsoft TrojanSpy:Win32/Nivdort.DA
ZoneAlarm HEUR:Trojan.Win32.Generic
GData Gen:Variant.Lazy.219050
Varist W32/Nivdort.G.gen!Eldorado
AhnLab-V3 Trojan/Win32.Nivdort.C1317722
Acronis suspicious
BitDefenderTheta AI:Packer.6C7B969F1E
ALYac Gen:Variant.Lazy.219050
VBA32 BScope.TrojanSpy.Nivdort
Cylance unsafe
Panda Trj/Genetic.gen
TrendMicro-HouseCall TROJ_BAYROB.SM7
Rising Trojan.Bayrob!1.A3C6 (CLASSIC)
Yandex Trojan.Agent!7B+rBQFQ5I4
Ikarus Trojan.Win32.Bayrob
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Bayrob.AQ!tr
AVG Win32:Vupa [Cryp]
DeepInstinct MALICIOUS
CrowdStrike win/malicious_confidence_100% (D)

How to remove TrojanSpy:Win32/Nivdort.DA?

Recommended second-opinion scan

Verify the infection before changing system settings

Use GridinSoft Anti-Malware to run a full scan, review detected persistence entries, and quarantine confirmed threats before restarting Windows.

Download GridinSoft Anti-Malware
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.