Fake Trojan

Trojan:Win32/Fakefolder.C removal guide

Malware Removal

The Trojan:Win32/Fakefolder.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan:Win32/Fakefolder.C virus can do?

  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Trojan:Win32/Fakefolder.C?


File Info:

crc32: 0A1DC912
md5: f7d19a245221c204f982e7ab6b5616a9
name: F7D19A245221C204F982E7AB6B5616A9.mlw
sha1: 39b05874eb294e47bc4a2a430e55b64da97aad34
sha256: 7c23d3d4deb55514d845c038a0c6532dd0a8bdc214c5431c02f9fd1de67b1cc3
sha512: 61b9b1d6720299c0861eba03c0a185c3f165fcff4c2751ab3dd5894182d13b08f26934d7ced2ea0bd5efc0c813a7c6148ebe3a08fad82df027b391e4598846aa
ssdeep: 768:sYuk15IMlH1dPiIVUc4gAD0Kste7B7E8qhX/M:sYukTnqIVUpV1Bo3vM
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

0: [No Data]

Trojan:Win32/Fakefolder.C also known as:

BkavW32.FamVT.IslamHAB.Trojan
Elasticmalicious (high confidence)
MicroWorld-eScanTrojan.Generic.6048691
FireEyeGeneric.mg.f7d19a245221c204
CAT-QuickHealTrojan.Fakefolder.C4
ALYacTrojan.Generic.6048691
CylanceUnsafe
VIPRETrojan.Win32.Generic.pak!cobra
SangforMalware
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderTrojan.Generic.6048691
K7GWTrojan ( 0026e0521 )
K7AntiVirusTrojan ( 0026e0521 )
InvinceaMal/Generic-S
BaiduWin32.Worm.FakeFolder.a
SymantecTrojan Horse
TotalDefenseWin32/FakeFLDR_i
APEXMalicious
KasperskyWorm.Win32.FakeFolder.a
NANO-AntivirusTrojan.Win32.Siggen3.erajeq
TencentTrojan.Win32.Fakefolder.my
Ad-AwareTrojan.Generic.6048691
SophosMal/Generic-S
F-SecureTrojan.TR/Agent.26624.EL
DrWebTrojan.Siggen3.15860
ZillyaWorm.FakeFolder.Win32.1
TrendMicroWorm.Win32.FAKEFOLDER.SMNH
McAfee-GW-EditionBehavesLike.Win32.Generic.pm
MaxSecureTrojan.Malware.300983.susgen
EmsisoftTrojan.Generic.6048691 (B)
JiangminWorm/FakeFolder.b
AviraTR/Agent.26624.EL
MAXmalware (ai score=82)
Antiy-AVLWorm/Win32.FakeFolder
KingsoftWin32.Heur.KVM007.a.(kcloud)
MicrosoftTrojan:Win32/Fakefolder.C
ArcabitTrojan.Generic.D5C4BB3
SUPERAntiSpywareTrojan.Agent/Gen-FakeFolder
ZoneAlarmWorm.Win32.FakeFolder.a
GDataTrojan.Generic.6048691
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.FakeFolder.R14407
McAfeeW32/Autorun!F7D19A245221
VBA32Worm.FakeFolder
MalwarebytesTrojan.Agent
PandaGeneric Malware
ZonerTrojan.Win32.56386
ESET-NOD32Win32/Agent.SQU
TrendMicro-HouseCallWorm.Win32.FAKEFOLDER.SMNH
RisingWorm.Fakefolder!1.B58E (CLASSIC)
YandexTrojan.GenAsa!rxwQ0RcDieY
IkarusTrojan.Win32.Fakefolder
eGambitGeneric.Worm
FortinetW32/FakeFolder.A!worm
BitDefenderThetaGen:NN.ZexaF.34634.cmGfaqhb8Rgb
AVGWin32:Evo-gen [Susp]
Cybereasonmalicious.45221c
AvastWin32:Evo-gen [Susp]
Qihoo-360HEUR/QVM11.1.595E.Malware.Gen

How to remove Trojan:Win32/Fakefolder.C?

Trojan:Win32/Fakefolder.C removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment