How to remove the Kovter Trojan (Removal Guide)

  • Filed Under :
  • March 23, 2016

The Kovter infection is a Trojan that performs click-fraud while running on your computer. This infection is typically installed via exploit kits found on hacked web sites or TrojanDownloaders like Nemucod. When Kovter is installed, the actual infection is stored in the Windows registry rather than as a file on your hard drive. This method of storing the malware files in the Registry rather than the hard drive makes it more difficult for antivirus programs to properly detect it.

Furthermore, when the infection is stored in memory it will create various autorun entries that start the infection when you login to the computer. The way these registry entries are made, makes it not possible to view the values or remove them with normal tools like the Windows Registry Editor. In fact, if you try to view the registry associated with Kovter it will display an error that states "Cannot display: Error reading the value's contents." as show below.

  • Unable to view Kovter Registry Keys

While infected, there are symptoms that indicate Kovter is installed on your computer. These symptoms include:

  • Task Manager will show numerous occurrences of mshta.exe or powershell.exe processes running as shown in the image below.

    DLLhost in Task Manager

  • Pages may be blocked or unreachable while you are browsing the web.

  • Your computer will act sluggish and programs will take a long time to start up.

  • Unusual disk activity.

  • Alerts stating that PowerShell has stopped working:

    DLLhost in Task Manager

Kovter is detected under various names depending on the particular anti-virus vendor. A list of vendors and their detection names for Kovter can be found below.

Definition Name
Anti-virus Vendor
Win32:Kovter-C Avast
Win32/Kovter.C ESET-NOD32
Trojan:Win32/Kovter!rfn Microsoft
Trojan.GenericKD.3112101 (B) Emsisoft
Trojan.Kotver
Trojan.Kotver!gen1
Trojan.Ransomlock.AK
Trojan.Ransomlk.AK!gm
Symantec
Trojan.Win32.Kovter.evv Kaspersky
Trojan.GenericKD.3112101 F-Secure
Ransom_.956D2004 Trend Micro
Trojan.GenericKD.3112101 BitDefender
Trojan.Kovter!Tocgra7MIok Agnitum
TR/Kovter.352313 Avira
Trojan.Kovter.88 DrWeb
Trojan/Kovter.c TheHacker
Trojan.Win32.Z.Kovter ViRobot
Trojan.Kovter Malwarebytes

As you can see, the Kovter Trojan is an intrusive infection that causes issues on your machine and can be difficult to remove. Thankfully, Symantec's Kovter Removal Tool can be used to easily remove this infection from your computer. Instructions on how to use this program are described in the removal guide below.

Self Help Guide

This guide contains advanced information, but has been written in such a way so that anyone can follow it. Please ensure your data is backed up before proceeding.

If you are uncomfortable making changes to your computer or following these steps, do not worry! Instead you can get free one-on-one help by asking in the forums.

To remove Kovter Trojan, follow these steps:

1

This removal guide may appear overwhelming due to the amount of the steps and numerous programs that will be used. It was only written this way to provide clear, detailed, and easy to understand instructions that anyone can use to remove this infection for free. Before using this guide, we suggest that you read it once and download all necessary tools to your desktop. After doing so, please print this page as you may need to close your browser window or reboot your computer.

2

To terminate any programs that may interfere with the removal process we must first download the Rkill program. Rkill will search your computer for active malware infections and attempt to terminate them so that they wont interfere with the removal process. To do this, please download RKill to your desktop from the following link.

img
Rkill

When at the download page, click on the Download Now button labeled iExplore.exe. When you are prompted where to save it, please save it on your desktop.

3

Once it is downloaded, double-click on the iExplore.exe icon in order to automatically attempt to stop any processes associated with Kovter Trojan and other malware. Please be patient while the program looks for various malware programs and ends them. When it has finished, the black window will automatically close and a log file will open. Please review the log file and then close so you can continue with the next step. If you have problems running RKill, you can download the other renamed versions of RKill from the rkill download page. All of the files are renamed copies of RKill, which you can try instead. Please note that the download page will open in a new browser window or tab.

Do not reboot your computer after running RKill as the malware programs will start again.

4

Kovter will change your Internet Explorer security settings so that you are unable to download files with it. To fix this, press the Windows key (Windows Key) on your keyboard, and while holding it down, also press the R key on your keyboard. This will open the Run dialog box as shown below.

Run Dialog

In the Open: field in the Run dialog box, type the text inetcpl.cpl, as shown in the image above, and then press the OK button. Once you press OK, the Internet Properties screen will open.

5

When the Internet Properties screen is open, click on the Security tab and you will be shown the security settings for Internet Explorer as shown below.

Now click on the Reset all zones to default level button as indicated by the blue arrow in the image above. After you press the reset button, click on the Apply button and then the OK button to save your changes and close the Internet Properties screen.

6

You can now open Internet Explorer or any other browser and download the Symantec Kovter Removal Tool. This tool comes in a 32-Bit and 64-Bit version, so make sure to download the version that has the same bit type as your installed version of Windows. To determine whether you are running a 32-bit or 64-bit version of windows, you can consult this tutorial: How to tell if you are running a 32-bit or 64-bit version of Windows.

img
Symantec Kovter Removal Tool

When saving the file, please save it to your desktop.

7

Once the Symantec Kovter Removal Tool has been downloaded look for the file called FixTool32.exe or FixTool64.exe, depending on which version you downloaded. When you have located the file, double-click on it to launch the program.

You will now be presented with a license agreement. Read through the agreement, and if you agree to it, click on the I Accept button to continue.

8

You will now be shown the main screen for the Symantec Kovter Removal Tool as shown below.

To scan for and remove Kovter, click on the Start button.

9

The Symantec Kovter Removal Tool will now scan for traces of the Kovter infection and remove any that are found.

10

When the removal tool has finished scanning and removing the infection, it will display a prompt that it has finished.

Scan Complete

11

You can now view the log, which will be saved in the same folder that the tool is located, to see what was removed. This logfile will be named after the removal tool name. So if you downloaded FixTool32.exe, it will be called FixTool32.log.

An example log can be seen below:

Log File

12

Now that you are back at the desktop, you should scan your computer with an anti-virus program. ESET has a free online scanner that you can use once to detect and delete infections. I suggest you use this to make sure there is no other malware present. The online scanner can be found here:

http://www.eset.com/us/online-scanner/
13

If the Symantec Kovter Removal Tool was unable to remove Kovter, then you should follow the steps here to request assistance from one of our malware removal experts:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

14

Now you should download HitmanPro from the following location and save it to your desktop:

img
HitmanPro

When you visit the above page, please download the version that corresponds to the bit-type of the Windows version you are using.

15

Once downloaded, double-click on the file named HitmanPro.exe (for 32-bit versions of Windows) or HitmanPro_x64.exe (for 64-bit versions of Windows). When the program starts you will be presented with the start screen as shown below.

HitmanPro Start Screen

Now click on the Next button to continue with the scan process.

16

You will now be at the HitmanPro setup screen. If you would like to install the 30 day trial for HitmanPro, select the Yes, create a copy of HitmanPro so I can regularly scan this computer (recommended) option. Otherwise, if you just want to scan the computer this one time, please select the No, I only want to perform a one-time scan to check this computer option.

Kickstart Setup Options

Once you have selected one of the options, please click on the Next button.

17

HitmanPro will now begin to scan your computer for infections, adware, and potentially unwanted programs. When it has finished it will display a list of all the items that Hitman has found as shown in the image below. Please note that the items found may be different than what is shown in the image.

MalwareBytes Scan Results

You should now click on the Next button to have HitmanPro remove the detected items. When it is done you will be shown a Removal Results screen that shows the status of the various programs that were removed. At this screen you should click on the Next button and then if prompted you should click on the Reboot button. If HitmanPro does not prompt you to reboot, please just click on the Close button.

Once your computer has has restarted or you pressed the Close button, you should now be at your Windows desktop.

18

As many malware and unwanted programs are installed through vulnerabilities found in out-dated and insecure programs, it is strongly suggested that you use Secunia PSI to scan for vulnerable programs on your computer. A tutorial on how to use Secunia PSI to scan for vulnerable programs can be found here:

How to detect vulnerable and out-dated programs using Secunia Personal Software Inspector

Your computer should now be free of the Kovter Trojan program. If your current security solution allowed this program on your computer, you may want to consider purchasing the full-featured version of HitmanPro to protect against these types of threats in the future.

If you are still having problems with your computer after completing these instructions, then please follow the steps outlined in the topic linked below:

Preparation Guide For Use Before Using Malware Removal Tools and Requesting Help

Are Your Protected?

While HitmanPro will scan and clean a computer for free, the free versions do not offer real-time protection. If you want to be fully protected at all times then it is recommended that you purchase a premium version.

img

HitmanPro

Purchase the full-featured version of HitmanPro, which includes discover viruses, trojans, rootkits, spyware and other malware on up-to-date and fully protected computers using cloud protection and behavioral detections, to protect yourself against these types of threats in the future!

Disclaimer: While we do earn a commission from the sale of the above products, rest assured we only recommend them due to their effectiveness.

View Associated Kovter Trojan Files

%LocalAppData%\evum\ %LocalAppData%\evum\1QGNQ.2MGvFO %AppData%\BlastoffCounterpoiseDissimilitude %AppData%\ForesideDopattaEmpyrean %AppData%\gangbang.dll %AppData%\htmlhelp.title.xml %AppData%\libertine.dll %AppData%\minimize_hover.png %AppData%\System.dll

File Location Notes:

%AppData% refers to the current users Application Data folder. By default, this is C:\Documents and Settings\<Current User>\Application Data for Windows 2000/XP. For Windows Vista and Windows 7 it is C:\Users\<Current User>\AppData\Roaming.

%LocalAppData% refers to the current users Local settings Application Data folder. By default, this is C:\Documents and Settings\<Current User>\Local Settings\Application Data for Windows 2000/XP. For Windows Vista, Windows 7, and Windows 8 it is C:\Users\<Current User>\AppData\Local.

View Associated Kovter Trojan Registry Information

HKCU\Software\Classes\.2MGvFO HKCU\Software\Classes\.2MGvFO\ ayC5 HKCU\Software\Classes\ayC5 HKCU\Software\Classes\ayC5\shell HKCU\Software\Classes\ayC5\shell\open HKCU\Software\Classes\ayC5\shell\open\command HKCU\Software\3c1cee05f3 HKCU\Software\Classes\ayC5\shell\open\command\ HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ [unreadable_char] HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ [unreadable_char]

This is a self-help guide. Use at your own risk.

BleepingComputer.com can not be held responsible for problems that may occur by using this information. If you would like help with any of these fixes, you can ask for malware removal assistance in our Virus,Trojan,Spyware, and Malware Removal Logs forum.

If you have any questions about this self-help guide then please post those questions in our Am I infected? What do I do? and someone will help you.

search guides

Login

Remember Me
Sign in anonymously