Trojan:Win32/Zloader.ARJ!MTB removal guide

The Trojan:Win32/Zloader.ARJ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Zloader.ARJ!MTB virus can do?

Executable code extraction
Creates RWX memory
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan:Win32/Zloader.ARJ!MTB?


File Info:
crc32: 840FFF04
md5: a6cc7d623a8051a8df730ce7560803e6
name: tmpw_2smu6s
sha1: 35517a744b44070df3a265e40af4a0f7c5ce52e5
sha256: 6ccc522969cad9fae5a80520f88440309c079bc9acf4b1aaf5e061602a5500b4
sha512: 1ec19df645694a76f4d69ee5495e8aa5a595ddf263920f4027b58e91f0f7b9ebb75fdce7273a9958024725c05242c3092f523e6bec26750cdfc49036655be1f2
ssdeep: 12288:BUeVJlfbhJTd58SHzh5uzMIts6DDt9USu0NMfMtQ:FJTdKSNGsQt2WNMM
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: RoseThose xa9 2017
InternalName: Art woman
FileVersion: 2.1.3.996
CompanyName: Win ToCase
ProductName: Horse.dll
ProductVersion: 2.1.3.996
FileDescription: RoseThose
Translation: 0x0409 0x04b0

Trojan:Win32/Zloader.ARJ!MTB also known as:

MicroWorld-eScan	Gen:Variant.Zusy.305852
FireEye	Generic.mg.a6cc7d623a8051a8
McAfee	GenericRXKY-JQ!A6CC7D623A80
Malwarebytes	Trojan.Crypt
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 005669021 )
BitDefender	Gen:Variant.Zusy.305852
K7GW	Trojan ( 005669021 )
BitDefenderTheta	Gen:NN.ZedlaF.34128.Eu8@aOuyBrii
F-Prot	W32/S-50dbd228!Eldorado
GData	Gen:Variant.Zusy.305852
Kaspersky	Trojan-Banker.Win32.Cridex.obk
Tencent	Malware.Win32.Gencirc.10cdd2f1
Ad-Aware	Gen:Variant.Zusy.305852
Sophos	Troj/Agent-BESY
Comodo	TrojWare.Win32.Kryptik.HACE@8so3pu
F-Secure	Trojan.TR/Kryptik.vxpvh
McAfee-GW-Edition	GenericRXKY-JQ!A6CC7D623A80
Emsisoft	Gen:Variant.Zusy.305852 (B)
Ikarus	Trojan.Win32.Krypt
Cyren	W32/S-50dbd228!Eldorado
Jiangmin	Trojan.Banker.Cridex.zq
Avira	TR/Kryptik.vxpvh
MAX	malware (ai score=85)
Antiy-AVL	Trojan[Banker]/Win32.Cridex
ZoneAlarm	Trojan-Banker.Win32.Cridex.obk
Microsoft	Trojan:Win32/Zloader.ARJ!MTB
Cynet	Malicious (score: 85)
AhnLab-V3	Trojan/Win32.Agent.C4117784
VBA32	TrojanBanker.Cridex
ALYac	Gen:Variant.Zusy.305852
ESET-NOD32	a variant of Win32/Kryptik.HDZG
Rising	Trojan.GenKryptik!8.AA55 (C64:YzY0OrmWw1Wdh5Rj)
Yandex	Trojan.GenKryptik!
SentinelOne	DFI – Suspicious PE
Fortinet	W32/Agent.BEVR!tr
AVG	Win32:Trojan-gen
Avast	Win32:Trojan-gen
Qihoo-360	HEUR/QVM40.1.EC08.Malware.Gen

How to remove Trojan:Win32/Zloader.ARJ!MTB?

Trojan:Win32/Zloader.ARJ!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X