Fake • Trojan

How to remove “Trojan.FakeMS.EDGen”?

The Trojan.FakeMS.EDGen is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.FakeMS.EDGen virus can do?

Unconventionial language used in binary resources: Korean
The binary likely contains encrypted or compressed data.
The executable is likely packed with VMProtect

How to determine Trojan.FakeMS.EDGen?


File Info:
crc32: EF5CD107
md5: acb231882de579ead97cc8041b8568ff
name: ACB231882DE579EAD97CC8041B8568FF.mlw
sha1: b19fd26026268ebdfc9510480b339edb0d127a2a
sha256: 20a6752b7ac4f6414c780e8d194c2faddb2625c3787b5aa3ebcbaa5bba0ad13f
sha512: b8aaa6c5674b2d02cc2956f3d0c1f292ac0506d40fec7c693129bf6188bb82cb253d5dd013f2cc26b8c23c3ff3e64f733e95c0983a553634dca6f803ad0d4585
ssdeep: 49152:IYkZP6yfPNo/myoR5Urm/CR71VX0c170kNZpsL8X0pS3ZQz02hmsZVlJDsGm9VI:I3ZHd3qm/qPkYiYX0pS36mwfJD6w/
type: PE32+ executable (console) x86-64, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: taskhost.exe
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7600.16385
FileDescription: Host Process for Windows Tasks
OriginalFilename: taskhost.exe.mui
Translation: 0x0409 0x04b0

Trojan.FakeMS.EDGen also known as:

K7AntiVirus	Trojan ( 00503d401 )
Lionic	Trojan.Win32.Miner.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop18.42431
MicroWorld-eScan	Gen:Variant.Bulz.499408
ALYac	Gen:Variant.Bulz.499408
Cylance	Unsafe
Zillya	Trojan.GenericKD.Win32.118752
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 00503d401 )
Cybereason	malicious.82de57
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win64/CoinMiner.BH
APEX	Malicious
Avast	Win64:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Bulz.499408
NANO-Antivirus	Trojan.Win64.Miner.falnzl
Ad-Aware	Gen:Variant.Bulz.499408
Sophos	Mal/Generic-S + Mal/Miner-AM
Comodo	Malware@#1domvwdo5cn8q
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win64.Generic.wc
FireEye	Generic.mg.acb231882de579ea
Emsisoft	Gen:Variant.Bulz.499408 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Miner.dcr
Avira	HEUR/AGEN.1114946
Antiy-AVL	Trojan/Generic.ASMalwS.25B90B9
Microsoft	Trojan:Win32/Skeeyah.A!rfn
Arcabit	Trojan.Bulz.D79ED0
GData	Gen:Variant.Bulz.499408
AhnLab-V3	Trojan/Win64.CoinMiner.R238465
McAfee	BackDoor-FDOH!ACB231882DE5
MAX	malware (ai score=95)
Malwarebytes	Trojan.FakeMS.EDGen
Panda	Trj/CI.A
Tencent	Win32.Trojan.Miner.Lqes
Ikarus	Trojan.Win64.CoinMiner
Fortinet	W64/CoinMiner.BH!tr
AVG	Win64:Malware-gen
Paloalto	generic.ml

How to remove Trojan.FakeMS.EDGen?

Trojan.FakeMS.EDGen removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X