Mal/FakeAV-JR removal guide

The Mal/FakeAV-JR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Mal/FakeAV-JR virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Uses Windows utilities to create a scheduled task
Anomalous binary characteristics

How to determine Mal/FakeAV-JR?


File Info:
name: A41658B08A7A4D45C2D4.mlw
path: /opt/CAPEv2/storage/binaries/39feebef36d414c504902b2ef8f0ebe79588ca813973a754cd07efc6b4eb6a22
crc32: A3F9ECA0
md5: a41658b08a7a4d45c2d4fcc950a8238a
sha1: ca905e8a6774ff81a9ff47f4b5d754e2c37c5c1b
sha256: 39feebef36d414c504902b2ef8f0ebe79588ca813973a754cd07efc6b4eb6a22
sha512: 7ea9e421e789682b6139daa6009ff6d55353af5c7fe62476404b8384e995c177ce33e7b1494cb37f2dfe2712726b8f103126ddbbb31abb658fd68b01238660a2
ssdeep: 6144:ocU1z0waO61dJ7RBxg+JlgNekEjiPISUOgW9X+hOGzC/NM:ocU1zxsBEGlgNekmZzcukG2/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11EA47E64F9AA4B23DD630234795AE1806776BC91E7A5C21B3015F32D22F37A01ABD77C
sha3_384: 3b79935a03ca7fd07b8730bb5045cac9d299cd34aede90cd62e4772f76f6a41ad93317c869ee72635bc8bc6a5a8aa70c
ep_bytes: 60b99c3102008a99ff0f400080c3d680
timestamp: 2007-06-02 06:27:43

Version Info:
CompanyName: TODO: 
FileDescription: TODO: 
FileVersion: 1.0.0.1
InternalName: AdwTest.exe
LegalCopyright: TODO: (c) .  All rights reserved.
OriginalFilename: AdwTest.exe
ProductName: TODO: 
ProductVersion: 1.0.0.1
Translation: 0x0409 0x04e4

Mal/FakeAV-JR also known as:

tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.Zusy.452805
ClamAV	Win.Malware.Razy-9759519-0
FireEye	Generic.mg.a41658b08a7a4d45
ALYac	Gen:Variant.Zusy.452805
Cylance	unsafe
VIPRE	Gen:Variant.Zusy.452805
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 004b494b1 )
K7AntiVirus	Trojan ( 004b494b1 )
Cyren	W32/Agent.FRS.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Agent.WTK
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	Trojan.Win32.Nobady.gen
BitDefender	Gen:Variant.Zusy.452805
NANO-Antivirus	Trojan.Win32.Mlw.fnxlgn
Avast	Win32:TrojanX-gen [Trj]
Tencent	Trojan.Win32.Agent.zl
Emsisoft	Gen:Variant.Zusy.452805 (B)
F-Secure	Trojan.TR/Agent.bzlwx
DrWeb	Trojan.MulDrop5.42246
TrendMicro	TROJ_GEN.R03BC0DEL23
McAfee-GW-Edition	BehavesLike.Win32.Generic.gm
Sophos	Mal/FakeAV-JR
SentinelOne	Static AI – Malicious PE
GData	Win32.Trojan.BadJoke.J
Jiangmin	Trojan.Agent.dulc
Avira	TR/Agent.bzlwx
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Agent.WTK
Xcitium	TrojWare.Win32.Aenjaris.ABC@8hq1l4
Arcabit	Trojan.Zusy.D6E8C5
ZoneAlarm	Trojan.Win32.Nobady.gen
Microsoft	Trojan:Win32/Aenjaris.AL!bit
Google	Detected
AhnLab-V3	Malware/Win.Generic.C5393361
Acronis	suspicious
McAfee	GenericRXOB-DF!A41658B08A7A
VBA32	SScope.Malware-Cryptor.Aenjaris
Malwarebytes	Generic.Trojan.Malicious.DDS
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R03BC0DEL23
Rising	Trojan.Agent!1.A728 (CLASSIC)
Ikarus	Trojan.Win32.Agent
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Agent.WTK!tr
BitDefenderTheta	Gen:NN.ZexaF.36196.Cu3@aqyzW2ki
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.08a7a4
DeepInstinct	MALICIOUS

How to remove Mal/FakeAV-JR?

Mal/FakeAV-JR removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X