About "W32/FakeFire-H" infection

The W32/FakeFire-H is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What W32/FakeFire-H virus can do?

Presents an Authenticode digital signature
Network activity detected but not expressed in API logs
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine W32/FakeFire-H?


File Info:
crc32: 21BFFC11
md5: c15a7c1de3fb0fc693e2cb119d907435
name: C15A7C1DE3FB0FC693E2CB119D907435.mlw
sha1: 0111669954d071cff37f01fbb64d89b2c406bdc1
sha256: adae51098026265d02164fc2441eb909109327ebebc18823089b25a2aa3e2ae1
sha512: 9793b1c9ae301f38b50f44cc753d7bd51a423ddba4b7176a0df38ab18f92d22c42b0b2362145e84a139783e8aa632f2f7feda30e0aa556753e398e53aa1f43a3
ssdeep: 49152:quN+DA+DrzSNRPLHkJEN8xmN3Aek03noj45wlDTLLfUT:j+8+2TDxeUJF3noxD8
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright 1984-2012 Adobe Systems Incorporated and its licensors. All rights reserved.
FileVersion: 11.0.04.63
CompanyName: Adobe Systems Incorporated
ProductName: Adobe Acrobat text extractor for non-PDF files
ProductVersion: 11.0.04.63
FileDescription: AcroTextExtractor
OriginalFilename: AcroTextExtractor.exe
Translation: 0x0409 0x04b0

W32/FakeFire-H also known as:

K7AntiVirus	Riskware ( 0049f6ae1 )
Lionic	Trojan.Win32.Malicious.4!c
Elastic	malicious (high confidence)
DrWeb	Win32.HLLW.Autoruner.547
Cynet	Malicious (score: 100)
ALYac	Gen:Trojan.Heur.bu0bsu6yu7db
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
Alibaba	Worm:Win32/FakeFire.b6fe439f
K7GW	Riskware ( 0049f6ae1 )
Cybereason	malicious.de3fb0
Cyren	W32/Skeeyah.AJ.gen!Eldorado
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:VB-FBX
ClamAV	Win.Trojan.Bulz-9865941-0
BitDefender	Gen:Trojan.Heur.bu0bsu6yu7db
MicroWorld-eScan	Gen:Trojan.Heur.bu0bsu6yu7db
Sophos	W32/FakeFire-H
BitDefenderTheta	AI:Packer.DFF53E5D1C
TrendMicro	WORM_AUTORUN.BGA
McAfee-GW-Edition	BehavesLike.Win32.CoinMiner.vh
FireEye	Generic.mg.c15a7c1de3fb0fc6
Emsisoft	Gen:Trojan.Heur.bu0bsu6yu7db (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1143083
Microsoft	Trojan:Win32/Tiggre!rfn
GData	Generic.Trojan.PSEB.DKB8H3
McAfee	Artemis!C15A7C1DE3FB
MAX	malware (ai score=80)
VBA32	Worm.AutoRun
TrendMicro-HouseCall	WORM_AUTORUN.BGA
Rising	Worm.VB!1.DA41 (CLASSIC)
Yandex	Trojan.GenAsa!g8z8LT30jj4
Ikarus	Trojan.Dropper
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Skeeyah.0764!tr
AVG	Win32:VB-FBX
Paloalto	generic.ml

How to remove W32/FakeFire-H?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “W32/FakeFire-H” infection