About “Rogue:Win32/FakePAV” infection

The Rogue:Win32/FakePAV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Rogue:Win32/FakePAV virus can do?

• Attempts to connect to a dead IP:Port (1 unique times)
• A process attempted to delay the analysis task.
• A process created a hidden window
• Drops a binary and executes it
• Performs some HTTP requests
• Unconventionial binary language: Urdu (Pakistan)
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Looks up the external IP address
• Uses Windows utilities for basic functionality
• Attempts to restart the guest VM
• Deletes its original binary from disk
• Attempts to stop active services
• Network activity contains more than one unique useragent.
• Installs itself for autorun at Windows startup
• Attempts to modify proxy settings
• Creates a copy of itself
• Attempts to disable UAC
• Attempts to modify UAC prompt behavior
• Uses suspicious command line tools or Windows utilities

Related domains:

How to determine Rogue:Win32/FakePAV?

File Info:
crc32: 1264C230
md5: 0a28317440a8d16bf7232782ed6c5f98
name: 0A28317440A8D16BF7232782ED6C5F98.mlw
sha1: 07c754a5458c0821e836f2f65508a023b9043b2d
sha256: c786e131fb32d85dedc1f7920a9b8957ab479a9feef16c39d4002da7f10473a0
sha512: 45882957d8f250233180f70c808b6af9b118d5da957ad3cc4afd7da47b4b0314ac3f6ae6a39dd41fb1aae66a61ee618218b4688431411102f2f96c0ed5d29556
ssdeep: 24576:LZzR1RcOBZRCDu7Q3WM4YT6U5+QzH8mIeHAYE4:hCOBGDcQ3WgT6MHhrHXE
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: HJF Copyright (C) 2013
FileDescription: HJF Ltd
LegalTrademarks: HJF Ltd
Comments: HJF Ltd
CompanyName: HJF Ltd
Translation: 0x0420 0x04b0

Rogue:Win32/FakePAV also known as:

How to remove Rogue:Win32/FakePAV?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.