Fake • Trojan

Trojan.FakeMS removal instruction

The Trojan.FakeMS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.FakeMS virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan.FakeMS?


File Info:
crc32: BA1A4E35
md5: 43a4fc6882e77af10af81b0d4b539309
name: rundll32.exe
sha1: 5a51901ed046c1d891db9798a50c7c1c7e4794fe
sha256: a1943e1049daed30fa89a0e73b4c130c00935e2aecb171141ecd2d05cf783f9e
sha512: 0567ae983675a0bbcacf2823f22ead444353c148bb73ad07544eecdb19665dcf41eab9ac0fa32897cce61a238d219ae8871eef222e365cbdda9a2d12547e9a35
ssdeep: 384:BamXASQKt3AVI7JBQxLl/2ee6bHeJhCWc5RHW:xXAU6I7nQxZ/2ee6bS8R
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: rundll
FileVersion: 10.0.14393.0 (rs1_release.160715-1616)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.14393.0
FileDescription: Windows host process (Rundll32)
OriginalFilename: RUNDLL32.EXE
Translation: 0x0804 0x04b0

Trojan.FakeMS also known as:

MicroWorld-eScan	Trojan.GenericKD.32745869
FireEye	Trojan.GenericKD.32745869
CAT-QuickHeal	Trojan.Multi
McAfee	RDN/Generic.glz
ALYac	Trojan.GenericKD.32745869
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.32745869
K7GW	Riskware ( 0040eff71 )
BitDefenderTheta	Gen:NN.ZexaF.32519.bu0@aarGuRij
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Generik.NJXSIP
TrendMicro-HouseCall	TROJ_GEN.R002C0PJK19
Avast	Win32:Malware-gen
GData	Trojan.GenericKD.32745869
Kaspersky	UDS:DangerousObject.Multi.Generic
Rising	Trojan.Generic@ML.83 (RDMK:vlq8u4rKjLN4foaDGTC2Dg)
Emsisoft	Trojan.GenericKD.32745869 (B)
Comodo	MalCrypt.Indus!@1qrzi1
F-Secure	Trojan.TR/Crypt.XPACK.Gen
TrendMicro	TROJ_GEN.R002C0PJK19
McAfee-GW-Edition	RDN/Generic.glz
Sophos	Mal/Generic-S
Cyren	W32/Trojan.AEAO-5357
Avira	TR/Crypt.XPACK.Gen
MAX	malware (ai score=99)
Arcabit	Trojan.Generic.D1F3A98D
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/DefenseEvasion!BV
VBA32	BScope.Trojan.Tiggre
Ad-Aware	Trojan.GenericKD.32745869
Malwarebytes	Trojan.FakeMS
Panda	Generic Malware
Ikarus	Trojan.Crypt
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	HEUR/QVM20.1.8ECF.Malware.Gen

How to remove Trojan.FakeMS?

Trojan.FakeMS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X