Trojan.GenericKDZ: what the alert means and what to do about it
Trojan.GenericKDZ is a generic detection name, followed by a signature number, that Bitdefender and products carrying its names give to a suspicious file; it is not a program you can uninstall. Check what the file is and where it came from first, then follow the scan and removal steps if it is really harmful.
Facts checked October 6, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
An automatic scan checks installed programs, startup items and browser extensions for anything that came with a Bitdefender-engine alert for Trojan.GenericKDZ on a file.
Do it yourself · free Remove Trojan.GenericKDZ yourself 5 steps, about 15 minutes, no software needed.
Start the steps
Trojan.GenericKDZ: summary
| Type | A generic trojan detection name used by Bitdefender and products that carry its names; not a program name |
|---|---|
| Risk | Unknown: the file behind the name is not documented. Treat as medium until you know what the file is and where it came from |
| Symptoms | The alert itself, with a number such as .79798 or .104283; no other sign in the three cases we read |
| How to get rid of it | Check the file first (path, source, SHA256 on VirusTotal); then Safe Mode full scan, Microsoft Defender Offline, reinstall the program from its maker; report doubtful files to Bitdefender |
| Our check (6 October 2026) | No PC test: we read three forum cases, a Bitdefender community answer and Microsoft's pages; no sample was run |
| Detection | No Microsoft detection name is known for this label; Microsoft names threats in its own Trojan:Win32/ scheme, and none of the cases we read shows one |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 8 more facts
| First seen | Our first guide 23 October 2020, showing the number .31004; the name is older, we found no first-seen date |
|---|---|
| Shown by | Bitdefender, Ad-Aware, eScan, Emsisoft (2020 table), Acronis Cyber Protect Home Office (2022), Windows Defender as reported by one reader (2024) |
| Not to be confused with | Trojan.GenericKD (the Bitdefender form without the Z), and Win32:Malware-gen, which is Avast's own label |
| Name | Trojan.GenericKDZ |
| Evidence | 0 write-ups by security sites; details still limited |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against three public forum cases from 2022 to 2024, a Bitdefender community moderator's answer of January 2024 and three Microsoft pages. We ran no sample and tested no PC; the removal steps follow Microsoft's pages and were not tried on a live infection.
What Trojan.GenericKDZ is, and what it is not
Trojan.GenericKDZ is a name that some antivirus products give to a file they judge suspicious, not the name of a program you can look up and uninstall. The name is followed by a number, for example Trojan.GenericKDZ.79798, and the number changes from one signature to the next.
- 1
What the name says
It says that a security product matched a file against a generic rule for trojans. It does not say what the file does, who made it or how it got there. Our 2020 guide called it a heuristic detection, and the cases we read since then fit that: the same name appeared on files that nobody had reason to distrust.
- 2
Who uses it
In the vendor table from our 2020 guide, Ad-Aware, BitDefender, eScan and Emsisoft show the name for one file, and most other vendors in the table show something else. In the 2022 to 2024 cases below it came from Bitdefender, Windows Defender (as the reader reported it) and Acronis Cyber Protect Home Office. We found no report from a vendor outside that circle, and the products may share a scanning engine (our reading, not something any vendor stated).
- 3
What Bitdefender says about the close relative
A Bitdefender community moderator wrote in January 2024 that Trojan.GenericKD is a generic detection name for a potential trojan, not a specific virus, and that a file other vendors do not flag is either a false positive or malware that does not meet their criteria for a detection. We found no Bitdefender page that defines the extra Z.
- Shown by
- Bitdefender, and products that carry the same names: Ad-Aware, eScan, Emsisoft and Acronis in our sources
- Usual form
- Trojan.GenericKDZ.<number>, for example .31004, .79798, .104283, .105566
- Platform
- Windows in every case we read; the old guide named no other system
- Is it a program?
- No. It is a label on a file, often a temporary file, an installer or a component of a program you installed yourself
- Not the same as
- A malware family with its own name such as Emotet or Agent Tesla, which vendors name when they have studied it
The label does not tell you which program caused it. From here the job is to find out whether the file is really harmful, which the next chapters help you do, and only then to remove it.
What Trojan.GenericKDZ does on an infected PC
How to read the name, part by part
Bitdefender does not publish a page that explains each letter of this name, so part of the table below is our reading and is marked as such.
| Part | What it means | Source of the meaning |
|---|---|---|
| Trojan | The behaviour class: a program that pretends to be harmless or hides its purpose and does not copy itself | Usual meaning in antivirus naming |
| Generic | The detection is a general rule, not a signature made for one studied sample | Bitdefender moderator, January 2024, about the GenericKD form |
| KD | A Bitdefender generic family label | We could not find Bitdefender's own definition of the two letters |
| Z | An extra letter on the same label | Not defined in anything we found; we do not guess what it stands for |
| Number after the dot | The id of one signature in the database: .31004 in 2020, .79798 in 2022, .104283 in 2023, .105566 in 2024 | Visible in the cases below; a new number is a new signature, so two reports with different numbers are different detections |
The old guide said the name can be linked to other known threats, so its severity cannot be known. That holds, but a better test is the number: look for the same number in a search engine and in the vendor tables on VirusTotal before you read anything into the name.
What we checked on 6 October 2026, and what we could not
There is no website to test and no file to run, because a detection name is not a program. We read four public cases from 2022 to 2024, a Bitdefender community answer and the vendor table from our 2020 guide, and we ran nothing on a PC.
Our reading of the sources, 6 October 2026
- The name is a real product messageThe Acronis, JRiver and Steam threads show the name coming from the readers' own security products, with a quarantine or delete action, not from a web page or a pop-up.
- It is not one fixed threatThe numbers differ between cases (.79798, .104283, .105566), and a Bitdefender moderator calls the GenericKD form a broad classification, not a specific virus.
- What the flagged file doesNot known. None of the three cases names a payload, and the 2020 table does not say which file was scanned.
- Real infection or false positiveNot settled in any of the cases. A JRiver administrator called one a false positive without a test; the Acronis reader and the Steam reader got no final answer.
- Other vendorsIn the 2020 table most vendors used other names for the same file, and in the Acronis case Norton 360 and Windows Defender scans found nothing. One scan that finds nothing is one data point.
- A clean second scanDoes not clear a file. Cloaked or newly released malware can be missed by one product and caught by another, and the reverse is also true for a harmless file.
Treat it as unconfirmed until you know what the file is The three cases we read look like false alarms on legitimate files, but we cannot prove that for yours. A quiet result on one scan never clears a file. Find out what the file is, where it came from and what other vendors say, then decide. Keep the PC off banking while you do.
How readers met it from 2020 to 2024
Our guide dates from 23 October 2020. The picture below is from it, and the other entries are reader reports in public forums.
23 October 2020
Our first guide
The 2020 guide treated the name as a generic trojan detection and showed a table of vendor results for one file. In it BitDefender, Ad-Aware, eScan and Emsisoft share one number, while other vendors name the same file differently.
From our 2020 guide: a table of vendor results in which Ad-Aware, BitDefender, eScan and Emsisoft show Trojan.GenericKDZ.31004 (Emsisoft adds (B)), while Avast, AVG, Alibaba, ESET and others use other names such as Win32:Malware-gen and Ransom:Win32/Cryptodef. The picture does not say which file was scanned. Not a screenshot we took. 3 July 2022
Temporary files quarantined again and again
A reader of Acronis Cyber Protect Home Office saw Trojan.GenericKDZ.79798 and Gen:Variant.Lazy.185473 in the activity log. Ten or eleven files were quarantined each time, all .tmp files in program folders and a Windows SysWOW64 folder, and 89 items sat in quarantine after a month. The reader also ran Norton 360 and Windows Defender, and both found nothing. A forum helper pointed out that two antivirus products running live protection are not recommended.
28 November 2023
A media player's installer
A JRiver Media Center 31 user got unexpected shutdowns, then a Bitdefender full scan deleted Media Jukebox/CDLabeler.exe from inside the Media Center installer in the AppData\Roaming\J River folder as Trojan.GenericKDZ.104283. The forum administrator answered that it is a false positive and to report it to Bitdefender.
January 2024
What Bitdefender's moderator wrote
In a thread about GenericKD alerts on macOS, a moderator said these are generic names for potential trojans, that other vendors may not agree, and that Bitdefender's malware researchers check files sent through its form. A file wrongly blocked has its detection removed within 72 hours, he wrote; if it persists after that, consider the file malicious.
15 February 2024
Every Proton version on Windows
A Steam user on Windows found Trojan.GenericKDZ.105566 in all Proton versions that Steam installed. The reader said Windows Defender and Bitdefender both showed it. Replies said generic and heuristic detections are mostly false alarms and advised checking the files on VirusTotal and contacting Valve or CodeWeavers, the makers.
Three of the four cases involved software that people had installed themselves from a normal source. That does not make the name harmless, but it explains why we put the check chapter before the removal chapter.
What Trojan.GenericKDZ can steal or download
What a real trojan can cost you
The old guide listed what typical trojans do. None of the three cases shows any of this for the name Trojan.GenericKDZ, so read the list as what could be behind a real detection, not as findings about every alert.
- High
Remote access
Some trojans give an attacker a way into the PC, so commands can be run and files taken without your knowledge.
- High
Stolen passwords and data
Trojans of this kind can take usernames, passwords, browser data and other details needed to log in, and send them to a server that the attacker controls.
- High
More malware
A trojan can download further threats, and the old guide also named ransomware as one possible payload. Some vendors in the 2020 table gave the file ransomware names such as Ransom:Win32/Cryptodef, though the table does not say which file it was.
- Medium
Mining and click fraud
Your PC can be used to mine coins or to click on adverts for someone else, which shows up as heat, a loud fan and slowness.
- Medium
Pop-ups and fake updates
Intrusive content can be injected into browsers, and pop-ups with fake update messages can trick you into installing tools you did not want.
- Medium
Changed Windows files
Altered system files, disabled functions or unwanted installed programs can damage the system even after the trojan is gone, as the old guide noted.
- Low
A needed file lost to a false alarm
If the detection is wrong and the product deletes the file, a program can stop working. In the JRiver case the installer file was deleted by the scan.
What you may notice, and what the cases show
The old guide said trojans are stealthy, so you may notice nothing at first. The cases agree: the alert was the only sign.
| Sign | What we found |
|---|---|
| The alert itself, with a number | In all three cases the first and only sign. The Acronis reader had 89 quarantined items and no other symptom. |
| Unexpected shutdowns of a program and of Windows | One JRiver user reported them in the week before the scan. The reader did not tie them to the file, and neither do we. |
| Slow PC, loud fan, high CPU at idle | The mark of a miner or of a busy background program. Not reported in the three cases. |
| New programs, new browser extensions, a changed home page or search engine | Not reported in the cases; check for them anyway if the file is not one you recognise. |
| Pop-ups with update messages | A sign of a different problem, usually a browser extension or a site that asked for notifications; do not follow them. |
| No sign at all | Does not clear a file, and does not prove an infection either. Trojans are built to stay quiet, and false alarms are quiet too. |
How to check the PC for Trojan.GenericKDZ
How a trojan like this gets onto a PC
No case we read says how a real Trojan.GenericKDZ file arrived. These are the usual routes, taken from the old guide, and the legitimate ways the same label appeared.
- 1
Cracked, pirated and modified files
The old guide said such threats mostly come in cracked, malicious or pirated files. Torrent sites, pirating services and peer-to-peer platforms are common sources, and a hacked site can offer a modified file that looks like the real one.
- 2
A booby-trapped email
A message about an invoice, an order or a payment, with an attachment or a link, is the classic way. The old guide advised ignoring messages from unknown senders and deleting emails that raise questions.
- 3
You run the file yourself
The old guide said attackers deliver malware without permission needed. In practice a trojan needs you to open or run something, which is why the check chapter asks where the file came from.
- 4
An installer, a game component or a temporary file
The three cases are of this kind: Proton files that Steam installed, an installer stored by a media player and .tmp files in program folders. A generic rule can match packed or unusual code in programs that are not harmful.
Whichever the route, the first sign is often only the alert, because a trojan does not announce itself.
Check the file before you delete anything
Write down exactly what the alert says before you click a button: the full name with its number, the product that raised it and the path of the file. Then find out what the file is.
- 1
Copy the alert
Take a photo or screenshot. Note the full name with the number, for example Trojan.GenericKDZ.104283, the file path and the product's name and version.
- 2
Ask what the file is
Look at the path. A file inside the folder of a program you installed from its maker, in a Steam library or in a program's own installer folder is a different case from a file in Downloads from an email or a cracked program.
- 3
Look at what else is running antivirus
Open Settings > Apps > Installed apps and look for a second security product with live protection. The Acronis helper said two such products on one PC are not recommended, because they can set each other off.
- 4
Get the file's fingerprint
Open Windows PowerShell and run
Get-FileHash "C:\path\to\file.exe" -Algorithm SHA256, with your own path. Search the hash on VirusTotal. One of the Steam replies advised using VirusTotal to compare the verdicts of many scanners; a few detections from little-known vendors usually mean a false alarm. Upload the file itself only if it holds nothing private. - 5
Read the numbers, not the colour
Check how many vendors flag it and which ones. A Bitdefender moderator says a file that other vendors do not flag is either a false positive or malware that does not meet their criteria. VirusTotal alone cannot tell which.
- 6
Look at what starts with Windows
Press Ctrl + Shift + Esc, open Startup apps, and note names you do not know. Microsoft's Autoruns, from Sysinternals, lists more places.
How to remove Trojan.GenericKDZ
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Programs like Trojan.GenericKDZ add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Trojan.GenericKDZ, its publisher or created on the day the problem started. Delete those folders, and check C:\Program Files and C:\Program Files (x86) too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Trojan.GenericKDZ that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Trojan.GenericKDZ can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove it from Windows 11 and Windows 10
The old guide said the cure is a proper anti-malware scan, in Safe Mode, and System Restore. Do the steps in order and stop when a scan is clean and the alert has not come back. We did not run these steps against a live infection; they follow Microsoft's pages.
- 1
Keep the file in quarantine, do not restore it
If your product has already quarantined the file, leave it there until you know what it is. Quarantine is reversible, and deleting is not: the JRiver reader lost an installer file to a delete action.
- 2
Disconnect, then back up documents
Turn off Wi-Fi or unplug the cable if you think the file is real. Copy documents and photos, not programs, to an external drive that you unplug afterwards.
- 3
Start in Safe Mode with Networking
Open Settings > System > Recovery, click Restart now beside Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 for Safe Mode with Networking. Microsoft says Safe Mode starts Windows in a basic state with a limited set of files and drivers, and that if a problem does not occur there, default settings and basic drivers are not the cause.
- 4
Run a full scan
In Windows Security > Virus & threat protection > Scan options choose Full scan and Scan now. Then run a full scan with the product that raised the alert, started by hand. If only one product finds it, go to the false-alarm chapter.
- 5
Run Microsoft Defender Offline
In Windows Security > Virus & threat protection > Scan options choose Microsoft Defender Offline scan and Scan now. Microsoft says it runs from a trusted environment outside the normal Windows kernel, so it can target malware that tries to get around the Windows shell, and that the PC restarts when it is done. Review the result under Protection history.
- 6
Quarantine or delete only what you cannot account for
If the scans and the check agree that the file is harmful, let the product quarantine it and then delete it. If the file belongs to a program you want, reinstall that program from its maker's site afterwards.
- 7
Try System Restore only if the alert began after a recent change
Press Windows logo + R, type
rstrui.exeand choose a restore point from before the change. Microsoft says System Restore reverts system files, registry settings and installed programs and does not touch personal files. Microsoft's page does not mention malware, so System Restore is not a cleaner: a restore point made after the infection brings the infection back. - 8
Last resort: reset Windows
Back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything, or reinstall from a USB installer. Restore documents only, no programs and no full system image.
Never download a removal program because a pop-up or a stranger tells you to. A real threat does not need a phone number or a payment page to fix, and a PC optimizer or repair tool is not a malware remover.
Could it be a false alarm?
Quite possibly. The three cases we read look like it, and a Bitdefender moderator invites you to send doubtful files to its researchers. Use the table to decide how careful to be.
| Points to a real infection | Points to a false positive |
|---|---|
| The file came from an email, a cracked program or a site you do not know | The file belongs to a program you installed from its maker, or to a Steam or Microsoft Store download |
| Many different vendors flag it on VirusTotal, with specific family names | Only Bitdefender and the products that carry its names flag it, with generic names |
| The PC behaves differently: unknown startup items, programs you did not install, new browser add-ons | The PC works normally and only the alert is odd |
| The alert returns after a scan from Safe Mode and after reinstalling the program | The alert stops after you reinstall the program from its maker |
| The same file is flagged again and again as a new copy appears in a temporary folder | Two security products with live protection are installed at once |
- 1
Send the file to Bitdefender
The moderator's answer points to Bitdefender's support form for incorrectly blocked files and says a detection that is wrong is removed within a maximum of 72 hours. If it persists after that, the moderator says to consider the file malicious.
- 2
Tell the maker of the program
In the Steam case replies said to contact Valve or CodeWeavers so that they can send the files to the antivirus makers. A false positive is fixed only when the vendor changes its rule.
- 3
Do not turn off protection
Do not switch off your security product or add the whole folder to its exclusions to stop the alert. Exclude one file only after you have confirmed that it is harmless.
After removal: passwords, accounts and prevention
Accounts come next
Because the PC showed A Bitdefender-engine alert for Trojan.GenericKDZ on a file in the list of installed apps, a sign of a program that could read browser data, the clean-up is only half of the work. The other half happens in your online accounts.
Change passwords from a clean device, beginning with e-mail; sign out of all sessions; check forwarding rules and recovery phone numbers; and turn on two-step verification with an authenticator app or a passkey. Ask your bank to replace cards saved in the browser.
Why the order matters and what to check in each account: secure your accounts after malware.
If it was real: what to do about your accounts
The scans above deal with the PC. These steps deal with what the trojan could have seen.
- 1
Change passwords from another device
Email first, then banking, then everything else. Turn on two-step sign-in. Do this before you use banking on the infected PC.
- 2
Sign out everywhere
Use the sign out of all sessions option in your Google, Microsoft and social accounts so stolen cookies stop working.
- 3
Check your money
Look at card statements and any wallets for payments you did not make.
- 4
Look for remote access tools
Open Settings > Apps > Installed apps and uninstall remote access programs you did not install, such as ones named desktop, remote or support.
- 5
Check that Windows still works
A trojan can leave disabled functions and changed settings behind even after it is removed. Open Windows Security and check that real-time protection is on, restart, and watch for a crash or a feature that no longer works. If one does, reset Windows.
- 6
Scan again in a week
A clean scan today does not clear code that hides. Run another full scan and a Defender Offline scan a week later and keep the alert screenshot.
Keep trojans off your PC
The old guide's advice still holds; here it is with current details.
Do
- Keep one security product with Real-time protection on. Microsoft Defender is built into Windows 11 and 10.
- Delete emails from unknown senders, especially about invoices, orders and payments, and open attachments only when you expected them.
- Install Windows Update monthly, and update browsers and PDF readers.
- Download programs from their makers' sites or the Microsoft Store.
- Keep a backup of documents on a disk you unplug (File History or OneDrive), so that a bad infection costs you a reinstall, not your files.
- Use a password manager and two-step sign-in so one stolen password does not open every account.
Don't
- Do not run cracks, keygens or files from torrent sites.
- Do not enable macros in a Word or Excel file from an email.
- Do not run two antivirus programs with live protection at once.
- Do not call a number shown in an alert or install a tool because a pop-up told you to.
Questions about Trojan.GenericKDZ
What is Trojan.GenericKDZ?
It is a generic detection name that Bitdefender and products carrying its detection names give to a file they find suspicious. The name followed by a number, such as Trojan.GenericKDZ.104283, marks one signature in the database, not one program.
A Bitdefender moderator described the related GenericKD form in January 2024 as a broad classification for potential trojans, not a specific virus. The name alone tells you neither what the file does nor whether it is harmful.
In the three cases we read, from 2022 to 2024, it appeared on temporary files, a media player installer and Proton files, and none of the readers found a payload.
Is Trojan.GenericKDZ a virus or a false positive?
It can be either, and a single alert cannot tell you which. A JRiver administrator called the 2023 alert a false positive, and Steam replies said generic and heuristic names are mostly false alarms. But a generic rule can also catch real malware, and the old guide listed what a real trojan can do.
Find out where the file came from, check its hash on VirusTotal and see which vendors flag it. If it is in a program you installed from its maker and only Bitdefender-engine products flag it, a false positive is likely. If it came from an email or a crack, treat it as real.
Which antivirus programs show Trojan.GenericKDZ?
In our sources it came from Bitdefender, and from products that show the same names:
- Ad-Aware
- eScan and Emsisoft in the vendor table of our 2020 guide
- Acronis Cyber Protect Home Office in a 2022 forum case
A Steam reader in 2024 said Windows Defender and Bitdefender both showed it, as the reader reported it. We found no report from other vendors, and most vendors in the 2020 table used other names for the same file. That the products share an engine is our reading, not something a vendor stated.
What does the number after GenericKDZ mean?
It identifies one signature in the vendor's database. The numbers we saw were .31004 in 2020, .79798 in 2022, .104283 in 2023 and .105566 in 2024, so newer signatures have bigger numbers. Two reports with different numbers are different detections, and a report of one number says nothing about another.
Bitdefender does not publish a page that explains the numbers or the letters KDZ, so we do not guess at their meaning. Use the number only to look for the same detection elsewhere, for example in a search engine or in the results for the file's hash on VirusTotal.
How do I remove Trojan.GenericKDZ from Windows 11 or 10?
First check the file, then remove it. Note the name, number and path, get the file's SHA256 hash with PowerShell and compare it on VirusTotal.
If the file is harmful or you cannot account for it, start in Safe Mode with Networking, run a full scan in Windows Security and then a Microsoft Defender Offline scan, and let your product quarantine what it finds.
Reinstall any program you want from its maker. Use System Restore only if the alert began after a recent change, and reset Windows as a last resort. We did not test these steps on a live infection.
Should I delete the file my antivirus flagged?
Quarantine it first, and delete it only when you know what it is. Quarantine can be undone, and deleting cannot. The JRiver reader's Bitdefender scan deleted an installer file and the administrator said the alert was false.
If the file belongs to a program that you installed from its maker, reinstall the program afterwards rather than restoring the flagged copy. If it came from an email, a crack or a site you do not know, delete it after the Safe Mode and Defender Offline scans, and then change your passwords from another device.
Why does only one antivirus find it?
Because generic rules differ between vendors. In the 2020 table most vendors named the same file differently, and in the 2022 Acronis case Norton 360 and Windows Defender scans found nothing while Acronis quarantined many files.
A Bitdefender moderator explains that a file other vendors do not flag is either a false positive or malware that does not meet their criteria.
That makes one quiet scan unhelpful in both directions: it does not prove the file safe, and one product's alert does not prove it harmful. Compare many vendors on VirusTotal and judge by where the file came from.
How do I report a false positive to Bitdefender?
Use the form that a Bitdefender moderator linked in a community answer in January 2024, Bitdefender support answer 29358, to send the file to its malware researchers. The moderator wrote that a wrongly blocked file has its detection removed within a maximum of 72 hours, and that a detection that persists after that should be considered malicious.
Give the full name with the number, the file's path and hash, and the program it belongs to. Tell the program's maker as well, as Steam replies advised for Proton, so that they can send it to the antivirus makers.
Can Trojan.GenericKDZ steal my passwords?
A real trojan can, but the name alone does not mean it did. The old guide said trojans can take usernames, passwords and other login data, and send them to the attacker. None of the three cases we read shows any theft.
If you have confirmed that the file was harmful, or you cannot rule it out, change your passwords from another device, email first and then banking. Turn on two-step sign-in, sign out of all sessions and check your card statements. If the file proved to be a false alarm, you do not need to change anything.
Will Fortect remove Trojan.GenericKDZ?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Trojan.GenericKDZ, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Acronis Forum: Acronis finds and quarantines malware that no other program detects, is this a false positive? (July 2022 to March 2024) (read October 6, 2026)
- JRiver Interact Forum: CDLabeller Virus? (28 November 2023) (read October 6, 2026)
- Steam Community, German forum: Trojan.GenericKDZ.105566 in Proton (15 to 18 February 2024) (read October 6, 2026)
- Bitdefender Expert Community: Positives in installation of Eclipse app on macOS Ventura 13 (moderator answer, January 2024, on Trojan.GenericKD and the false-positive form) (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Support: System Restore (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)