Trojan.Fakealert.25889 malicious file

The Trojan.Fakealert.25889 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Fakealert.25889 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Tries to unhook or modify Windows functions monitored by Cuckoo
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Creates a copy of itself

How to determine Trojan.Fakealert.25889?

File Info:
name: 25975D53E5E84A96D5B3.mlw
path: /opt/CAPEv2/storage/binaries/203a267d8b02881e74b63b577a772bfb596942e4aad80de4bb7e0eecef87f214
crc32: 3C38499D
md5: 25975d53e5e84a96d5b37b958d2cc281
sha1: 9b46f0e8e1348e080bfa0382ea7f7076a8a78f9a
sha256: 203a267d8b02881e74b63b577a772bfb596942e4aad80de4bb7e0eecef87f214
sha512: ba606cb71d51048a9caeced755722e698f4496bf3ed70df2f2052f87684e9706e8addf5330b62488d8a4b67eefb24385401fe681d19630d521a9a33c103e6a78
ssdeep: 1536:zXldECI13Fa8TgM3+caKoy7waSbICRpCxm8BoaazhBCYXKe8++9QjUZAv/Rn7co:ZdZI1VpT9+cas0aSPXCk8BpIBCYXFVjB
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T160931282D4541206E23FAD7FABD958023D3A76D38C4298BFAF9538D70635ED243625E2
sha3_384: e21a564fb8cad3d2bc9227c1979d05d3c0e9bcb62390c9dad27cfdcc60861c8d56d6ac377c0f4cbd90fa6433c69db7b5
ep_bytes: 60be217043008dbedf9ffcff57eb0b90
timestamp: 2008-11-30 13:34:46

Version Info:
CompanyName: UXB SOFTWIN
FileDescription: UXB BitDefender
FileVersion: 806
InternalName: Tvhlawtw
LegalCopyright: Copyright © Tvhlawtw Software 2000-2011
OriginalFilename: Tvhlawtw.exe
ProductName: Tvhlawtw Khpnmu Egbuxppc
ProductVersion: 6.9
Translation: 0x0409 0x04e4

Trojan.Fakealert.25889 also known as:

How to remove Trojan.Fakealert.25889?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.