Short Bio

Trojan.Kovter is a detection for a family of malware that has many faces, but the main variants are aimed at performing ad fraud and are very hard to detect and remove as they use fileless infection method.

Common infection method

Kovter usually arrives in mail attachments as a Macro in a Word document file. When activated, the Macro downloads a file that creates a PowerShell command stored in the registry to gain persistence. Then the randomly named file deletes itself.


Most of the time, Malwarebytes can remove Trojan.Kovter without further user interaction. In some cases, Malwarebytes Anti-Rootkit BETA is needed to find and delete the malicious registry key.

Cybersecurity info you can’t do without

Want to stay informed on the latest news in cybersecurity? Sign up for our newsletter and learn how to protect your computer from threats.

Select your language