About “Trojan-FakeAV.Win32.XpAntivirus.wuw” infection

The Trojan-FakeAV.Win32.XpAntivirus.wuw is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-FakeAV.Win32.XpAntivirus.wuw virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Reads data out of its own binary image
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan-FakeAV.Win32.XpAntivirus.wuw?

File Info:
name: 9B7619EF175578FB5D74.mlw
path: /opt/CAPEv2/storage/binaries/bf44b6e74041ec0fefcb0be995914b6a942cae72fd745bd170d62c0ad3caa730
crc32: BD6E0D59
md5: 9b7619ef175578fb5d741cec600d3ced
sha1: b0cea1c22712ed6fa690f6ce843ab93b374a8bfe
sha256: bf44b6e74041ec0fefcb0be995914b6a942cae72fd745bd170d62c0ad3caa730
sha512: 5fa8f79d334de6ff5b0a4a6249545ebef662faf7dad62964fd70d8138eb9b32948e60f16e382dcd41a4027a88d0314309326cf3522136155ff631200cb2181e4
ssdeep: 3072:ZEaFWtQLdt451eODOJCphbS/vazshkiXrFIpadYJpn4YKplKoZWp35ryo:r4tQLzOcCfG/vlhkox1dep4npQrryo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1352401088174E80ED9B5DFFD9223C074806FEC158CD705969AE6BBEABE31F443116B5A
sha3_384: 9b58dc878b132b710cab45fe8a4920734ffaab1faa907f309b0a51854335b3b1d0d51a8e22b9d60000b60aea371ee1fa
ep_bytes: 60be00f042008dbe0020fdff5783cdff
timestamp: 2015-07-03 09:36:39

Version Info:
CompanyName: Spotify Ltd
FileDescription: SpotifyInstaller
FileVersion: 0,0,0,0
InternalName: SpotifyInstaller
LegalCopyright: Copyright (c) 2015, Spotify Ltd
OriginalFilename: SpotifyInstaller.exe
ProductName: Spotify
ProductVersion: 1.0.9.133.gcedaee38
Translation: 0x0000 0x04b0

Trojan-FakeAV.Win32.XpAntivirus.wuw also known as:

How to remove Trojan-FakeAV.Win32.XpAntivirus.wuw?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.