How to remove “Win32/Patched.NKV”?

The Win32/Patched.NKV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Patched.NKV virus can do?

Authenticode signature is invalid
CAPE detected the shellcode get eip malware family
Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Patched.NKV?


File Info:
name: 030183DD24D0E3EB4ADB.mlw
path: /opt/CAPEv2/storage/binaries/1fc4a993c7068d8b2ba61b83c3a86d70dd360cf6aec80fd924f2c998b426e2a9
crc32: D8962BEB
md5: 030183dd24d0e3eb4adb9d3b69f01955
sha1: 8814d31d105951aa6c6c1d0a5200c052e88d502f
sha256: 1fc4a993c7068d8b2ba61b83c3a86d70dd360cf6aec80fd924f2c998b426e2a9
sha512: e93fcc107e11b45fef70c7456952acf80329e0dcbfc316c03fc04b8c73d6d265135e34e722e207168b82a9fdc1cd64c9145db8c061ae70b785589895d2707203
ssdeep: 768:BqDWKJKmy5cSn9R8m4wO0Yj9g8WTmYB6vhF:BqDWKJK8Sn9R8mfw9gHdE3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T12FE26E42BBC710B2E293847149F256E65AFFBE116FB5041FCB80360E2D325C9862A773
sha3_384: 5ab0e790e2073d062bc3c11eb82449a47471738fc06e3030f581c6677149498e59630aa7dbe91905cd6c009ff2e3a7a1
ep_bytes: 558bec83ec44535657ff15a85040008b
timestamp: 1999-03-26 11:17:32

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Microsoft® Visual FoxPro® HTML Help Support
FileVersion: 6.0.8450.0
InternalName: FOXHHELP
LegalCopyright: Copyright© Microsoft Corp. 1993-1998
LegalTrademarks: Microsoft® is a registered trademark of Microsoft Corporation.
OriginalFilename: FOXHHELP.EXE
ProductName: Microsoft® Visual FoxPro®
ProductVersion: 6.0.8450.0
OLESelfRegister: 
Translation: 0x0409 0x04e4

Win32/Patched.NKV also known as:

Bkav	W32.Common.C128F25C
Lionic	Virus.Win32.Agent.n!c
AVG	Win32:Injected-AZ
MicroWorld-eScan	Gen:Malware.Heur.1.!copidmbe!.bq0@bKzNlEii
FireEye	Generic.mg.030183dd24d0e3eb
Skyhigh	BehavesLike.Win32.Virut.nh
McAfee	Artemis!030183DD24D0
Cylance	unsafe
Zillya	Trojan.Agent.Win32.3867423
Sangfor	Trojan.Win32.Agent.Vydw
Alibaba	Trojan:Win32/Generic.4e85d9ac
BitDefenderTheta	Gen:NN.ZexaF.36804.bq0@aKzNlEii
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Patched.NKV
Cynet	Malicious (score: 99)
APEX	Malicious
ClamAV	Win.Trojan.Agent-711007
Kaspersky	Virus.Win32.Agent.kq
BitDefender	Gen:Malware.Heur.1.!copidmbe!.bq0@bKzNlEii
Avast	Win32:Injected-AZ
Emsisoft	Gen:Malware.Heur.1.!copidmbe!.bq0@bKzNlEii (B)
F-Secure	Trojan.TR/Spy.31232.90
VIPRE	Gen:Malware.Heur.1.!copidmbe!.bq0@bKzNlEii
TrendMicro	TROJ_GEN.R002C0RK423
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Patched
Webroot	W32.Injector.Gen
Avira	TR/Spy.31232.90
Microsoft	Trojan:Win32/Phonzy.A!ml
Xcitium	Malware@#3nok28m3cdhp3
Arcabit	Gen:Malware.Heur.1.!copidmbe!.EABAB4
ZoneAlarm	Virus.Win32.Agent.kq
GData	Gen:Malware.Heur.1.!copidmbe!.bq0@bKzNlEii
Google	Detected
MAX	malware (ai score=99)
Malwarebytes	Generic.Malware/Suspicious
Panda	Generic Suspicious
TrendMicro-HouseCall	TROJ_GEN.R002C0RK423
SentinelOne	Static AI – Suspicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Patched.NKV!tr
DeepInstinct	MALICIOUS
alibabacloud	Virus:Win/Patched.NKV

How to remove Win32/Patched.NKV?

Win32/Patched.NKV removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X