FakeAV.91 (B) removal instruction

The FakeAV.91 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What FakeAV.91 (B) virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
A process attempted to delay the analysis task.
Performs some HTTP requests
Unconventionial language used in binary resources: Nepali (India)
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Attempts to identify installed AV products by installation directory
Checks the CPU name from registry, possibly for anti-virtualization

Related domains:

iplogger.org

apps.identrust.com

filelss07.top

How to determine FakeAV.91 (B)?


File Info:
crc32: 414731C7
md5: 03646964ec3cfb95b37ca1e940923579
name: tmpm32qt7hu
sha1: c49760f02f87ae3b5ec6bf0ae217a4583f7ecc8b
sha256: 0dece9fdaaf9fca84d4ea64f94e789ee03a7a7e663d138327c662c4fc23aa2bb
sha512: 83fdab0ac26d1c47826773e8fa80e1c346d36fa4c9b34e49c54ca6f80e8f9e19364345ee556fb6609bacba9ba519e3efb8b73e001b3cdecaa8c02278277401bc
ssdeep: 12288:RpV9VIBSibAz4SirmW7DmXB/K8bZOK1mtDIP/0DT:R4vAE3rmaCXBygmzT
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
0: [No Data]

FakeAV.91 (B) also known as:

Bkav	HW32.Packed.
MicroWorld-eScan	Gen:Variant.FakeAV.91
FireEye	Generic.mg.03646964ec3cfb95
Qihoo-360	HEUR/QVM10.1.EC7B.Malware.Gen
McAfee	Artemis!03646964EC3C
Cylance	Unsafe
Sangfor	Malware
BitDefender	Gen:Variant.FakeAV.91
Cybereason	malicious.4ec3cf
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Evo-gen [Susp]
Ad-Aware	Gen:Variant.FakeAV.91
Emsisoft	Gen:Variant.FakeAV.91 (B)
F-Secure	Trojan.TR/Crypt.XPACK.Gen3
McAfee-GW-Edition	BehavesLike.Win32.SoftPulse.jc
Trapmine	malicious.moderate.ml.score
SentinelOne	DFI – Malicious PE
Avira	TR/Crypt.XPACK.Gen3
Endgame	malicious (high confidence)
Arcabit	Trojan.FakeAV.91
Microsoft	Trojan:Win32/Wacatac.D!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
ALYac	Gen:Variant.FakeAV.91
MAX	malware (ai score=89)
Rising	Malware.Heuristic!ET#92% (RDMK:cmRtazo6esNtT0SdeYnaj+K2KfcB)
eGambit	Unsafe.AI_Score_99%
GData	Gen:Variant.FakeAV.91
AVG	Win32:Evo-gen [Susp]
CrowdStrike	win/malicious_confidence_100% (D)
MaxSecure	Trojan.Malware.300983.susgen

How to remove FakeAV.91 (B)?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

FakeAV.91 (B) removal instruction