Malware

How to remove “Jaik.48175”?

Malware Removal

The Jaik.48175 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Jaik.48175 virus can do?

  • Executable code extraction
  • Creates RWX memory
  • Attempts to execute a powershell command with suspicious parameter/s
  • Reads data out of its own binary image
  • A process created a hidden window
  • Drops a binary and executes it
  • Executed a very long command line or script command which may be indicative of chained commands or obfuscation
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Detects VirtualBox using WNetGetProviderName trick
  • Installs itself for autorun at Windows startup
  • Checks the version of Bios, possibly for anti-virtualization
  • Attempts to disable Windows Defender
  • Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Jaik.48175?


File Info:

crc32: F21BF375
md5: 04991038871911a613c1d66be6a8f5f1
name: 04991038871911A613C1D66BE6A8F5F1.mlw
sha1: 177a63fe42966c2753b4ea84bf651046b897f905
sha256: 7ce2c7650ed812d6539580c71e506560a61aac727a66c483f6b0fd663cfd47ca
sha512: 24f8c5fbe7f45f75a344054f65b04efc9d08152bc1ddddccb4ab8928bd99c8fc9c2d153e8da98f2ed95041580ecaf4c0dcc3f2046da9dc5caaed82484be9cd3c
ssdeep: 196608:91OtUlPfVOuYEyRL+l18G0zcL0/3aA+KddPy4EqbS:3OtUlVOu76KcGoFj+oyXqbS
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (c) 1999-2010 Igor Pavlov
InternalName: 7zS.sfx
FileVersion: 9.20
CompanyName: Igor Pavlov
ProductName: 7-Zip
ProductVersion: 9.20
FileDescription: 7z Setup SFX
OriginalFilename: 7zS.sfx.exe
Translation: 0x0409 0x04b0

Jaik.48175 also known as:

K7AntiVirusAdware ( 00581def1 )
Elasticmalicious (high confidence)
ALYacGen:Variant.Jaik.48175
CylanceUnsafe
AlibabaTrojan:Win32/Bingoml.3a407bbe
K7GWAdware ( 00581def1 )
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Adware.Neoreklami.LI
APEXMalicious
AvastWin32:Adware-gen [Adw]
CynetMalicious (score: 100)
KasperskyTrojan.Win32.Bingoml.cpen
BitDefenderGen:Variant.Jaik.48175
MicroWorld-eScanGen:Variant.Jaik.48175
Ad-AwareGen:Variant.Jaik.48175
SophosGeneric ML PUA (PUA)
BitDefenderThetaGen:NN.ZexaF.34236.@JW@a8fBz3j
McAfee-GW-EditionGenericRXQG-KA!7D2F1FF71C09
FireEyeGen:Variant.Jaik.48175
EmsisoftGen:Variant.Jaik.48175 (B)
SentinelOneStatic AI – Malicious SFX
JiangminTrojan.Multi.equ
AviraADWARE/Neoreklami.kpgyz
GDataGen:Variant.Jaik.48175
McAfeeArtemis!049910388719
MAXmalware (ai score=85)
VBA32Trojan.Wacatac
MalwarebytesAdware.Neoreklami
RisingTrojan.Generic@ML.88 (RDMK:Tpw/GvSfvteRFFwa0WrjuA)
IkarusPUA.Neoreklami
FortinetAdware/Neoreklami
AVGWin32:Adware-gen [Adw]

How to remove Jaik.48175?

Jaik.48175 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment