Trojan:Win32/Tovtaker.RB!MTB removal guide

The Trojan:Win32/Tovtaker.RB!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Tovtaker.RB!MTB virus can do?

Reads data out of its own binary image
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Tovtaker.RB!MTB?


File Info:
name: 7425A2B438E74A9BC821.mlw
path: /opt/CAPEv2/storage/binaries/577a6f59faf43473c13cbf729894400a419e063a69a75c0d8bb51084bd50095f
crc32: 5D1AF100
md5: 7425a2b438e74a9bc821b8076285911f
sha1: d14c658b26d5ce54474d6c8c1dd63fd51a47e2e1
sha256: 577a6f59faf43473c13cbf729894400a419e063a69a75c0d8bb51084bd50095f
sha512: 3ca0a6678489a90f27c21076a71c55e950983877ded158847a0417b926d9938e9c5a9df25ba50de52ad0d14c9e31dc9e06509bc21b8e3eb14c684fc48a4634de
ssdeep: 3072:i5ZD8Rp234ZPHEf6uOeIzTe5MRkw+RIUQFv4NWOj84H:q4REIZPE1oT+U4xJH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E9C36C1174C0C072E477193109F9DAA54A6DFD300F785BEBA3DC127A4F746E0AA39AA7
sha3_384: b589d2532ce2b66b0882567b141d23ec43865193e20f73915ead14fcef0f10c5d2f13fe9043b5fb1a0d729383b1bad3b
ep_bytes: e889040000e980feffff558bec6a00ff
timestamp: 2017-11-09 09:31:39

Version Info:
OriginalFilename: linja.exe
LegalCopyright: © Alabama tream. All rights reserved.
ProductVersion: 5.2.11.3
CompanyName: Gluer berrot valer
FileDescription: Klazzer gerat astream
FileVersion: 5.2.11.3
InternalName: Teebatijanerteas
ProductName: CATREPI Boes
Translation: 0x0409 0x04b0

Trojan:Win32/Tovtaker.RB!MTB also known as:

Bkav	W32.Common.74E91844
Lionic	Trojan.Win32.Tovkater.a!c
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Fugrafa.31689
FireEye	Gen:Variant.Fugrafa.31689
CAT-QuickHeal	PUA.MauvaiseRI.S5255025
Skyhigh	RDN/Generic Downloader.x
McAfee	RDN/Generic Downloader.x
Cylance	unsafe
Zillya	Downloader.Tovkater.Win32.605
Sangfor	Downloader.Win32.Tovkater.V3dp
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:Win32/Tovkater.dded5b1e
K7GW	Trojan-Downloader ( 0051b8381 )
K7AntiVirus	Trojan-Downloader ( 0051b8381 )
BitDefenderTheta	Gen:NN.ZexaF.36744.hy0@a0X06lpi
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/TrojanDownloader.Tovkater.GX
APEX	Malicious
Kaspersky	Trojan-Downloader.Win32.Tovkater.asgv
BitDefender	Gen:Variant.Fugrafa.31689
NANO-Antivirus	Trojan.Win32.InstallMonster.icpuvc
Avast	Win32:Malware-gen
Tencent	Win32.Trojan-Downloader.Tovkater.Xwhl
Emsisoft	Gen:Variant.Fugrafa.31689 (B)
F-Secure	Trojan.TR/Tovkater.srnuq
DrWeb	Trojan.InstallMonster.2414
VIPRE	Gen:Variant.Fugrafa.31689
TrendMicro	Possible_HPGen-32
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-R
GData	Gen:Variant.Fugrafa.31689
Jiangmin	TrojanDownloader.Tovkater.w
Google	Detected
Avira	TR/Tovkater.srnuq
Varist	W32/Tovkater.Q.gen!Eldorado
Antiy-AVL	Trojan[Downloader]/Win32.Tovkater
Xcitium	Application.Win32.InstallMonster.DX@7e9j3l
Arcabit	Trojan.Fugrafa.D7BC9
ViRobot	Trojan.Win32.Z.Tovkater.128000
ZoneAlarm	Trojan-Downloader.Win32.Tovkater.asgv
Microsoft	Trojan:Win32/Tovtaker.RB!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Abnores.R211818
VBA32	TrojanDownloader.Tovkater
ALYac	Gen:Variant.Fugrafa.31689
MAX	malware (ai score=99)
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Possible_HPGen-32
Rising	Trojan.Generic@AI.90 (RDML:0OQphnjGPCpo6j4s89zhwQ)
Yandex	Trojan.DL.Tovkater!AckeeURq5+M
Ikarus	Trojan-Downloader.Win32.Tovkater
MaxSecure	Trojan.Malware.11559870.susgen
AVG	Win32:Malware-gen
Cybereason	malicious.b26d5c
DeepInstinct	MALICIOUS

How to remove Trojan:Win32/Tovtaker.RB!MTB?

Trojan:Win32/Tovtaker.RB!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X