About "Jaik.47979" infection

The Jaik.47979 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Jaik.47979 virus can do?

Executable code extraction
Creates RWX memory
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Drops a binary and executes it
Unconventionial language used in binary resources: Chinese (Simplified)
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a hidden or system file
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

al-sy.youtu-tv.com

How to determine Jaik.47979?


File Info:
crc32: D49CC60A
md5: ff64906b11528c53152738a2bd6c9caf
name: FF64906B11528C53152738A2BD6C9CAF.mlw
sha1: fe4abda528c86c99d3216d4bc0148e59ab579dcb
sha256: fcf27e26346dcf0dc51de742d85f75ca0e56d89cba70932b90dd4d11311e38b9
sha512: ab22a94f3a3014e35d721696294ebfe1d2c72dee031b5ce8c5e349cf824e4533b1fcf4f36e6b0d12c6977bd0af98c3826f36f58ee6f19eb9d848cee15bfbfbae
ssdeep: 24576:ufnAFlGkImrRhbXz0Jsz/4wBopV8/+YiwW:ynIAkI0zx16V8/
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 1996 Microsoft Corp.
InternalName: installer
FileVersion: 6.00.8169
CompanyName: Microsoft Corporation
LegalTrademarks: Microsoftxae is a registered trademark of Microsoft Corporation.  Windows(TM) is a trademark of Microsoft Corporation
ProductName: Remote Automation Connection Manager Server 5.0
OLESelfRegister: 
ProductVersion: 6.00.8169
FileDescription: Remote Automation Connection Manager Server
OriginalFilename: racreg32.dll
Translation: 0x0409 0x04b0

Jaik.47979 also known as:

K7AntiVirus	Trojan ( 005781261 )
Elastic	malicious (high confidence)
DrWeb	BackDoor.Farfli.131
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Ulise.301618
Cylance	Unsafe
Zillya	Trojan.GenKryptik.Win32.75051
K7GW	Trojan ( 005781261 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/GenKryptik.FDDY
APEX	Malicious
Avast	Win32:Trojan-gen
ClamAV	Win.Malware.Deepscan-6824107-0
BitDefender	Gen:Variant.Jaik.47979
MicroWorld-eScan	Gen:Variant.Jaik.47979
Tencent	Malware.Win32.Gencirc.10cecf75
Ad-Aware	Gen:Variant.Jaik.47979
F-Secure	Trojan.TR/AD.Farfli.yyrqj
BitDefenderTheta	Gen:NN.ZexaF.34170.js0@aqjj7kej
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.ff64906b11528c53
Sophos	Mal/Generic-S
SentinelOne	Static AI – Suspicious PE
Jiangmin	Backdoor.Farfli.eoz
Avira	TR/AD.Farfli.yyrqj
Antiy-AVL	Trojan[Backdoor]/Win32.Farfli
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Farfli.DSK!MTB
Gridinsoft	Trojan.Win32.Kryptik.oa!s1
ZoneAlarm	HEUR:Backdoor.Win32.Farfli.gen
GData	Gen:Variant.Jaik.47979
McAfee	GenericRXAA-AA!FF64906B1152
MAX	malware (ai score=82)
VBA32	BScope.Trojan.Pynamer
Malwarebytes	Generic.Trojan.Malicious.DDS
Rising	Trojan.Kryptik!1.D241 (CLASSIC)
Fortinet	W32/GenKryptik.EOZH!tr
AVG	Win32:Trojan-gen

How to remove Jaik.47979?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Jaik.47979” infection