About “Win32/TrojanDownloader.FakeAlert.BGV” infection

The Win32/TrojanDownloader.FakeAlert.BGV is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/TrojanDownloader.FakeAlert.BGV virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Performs HTTP requests potentially not found in PCAP.
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• CAPE detected the shellcode patterns malware family
• Checks for the presence of known devices from debuggers and forensic tools
• Checks for the presence of known devices from debuggers and forensic tools
• Attempts to modify proxy settings
• Creates a copy of itself
• Touches a file containing cookies, possibly for information gathering
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/TrojanDownloader.FakeAlert.BGV?

File Info:
name: DAD21758C891235CFAD1.mlw
path: /opt/CAPEv2/storage/binaries/3b7ea7b0657b4c9aa099b6194365598aee63ada1c83c3cc02dad0160c4389e6b
crc32: 535B4B5F
md5: dad21758c891235cfad1624038833945
sha1: 9745081111bdf867af208684b9d2e5f66c45fa1d
sha256: 3b7ea7b0657b4c9aa099b6194365598aee63ada1c83c3cc02dad0160c4389e6b
sha512: 52a7af07ceafe669c45af17cba97d79efec0db65f7da1e12dbbc930f7a4321d3b615ecd28e2261a1b90ac84bf9788cf16225252b1520e0b0ec49c8f38458572e
ssdeep: 6144:XtPgL7YxKsOJ5shbsqtUzRQEIheo2plNcFIAtvG5zvSlPc:yabQQE+e8FIORc
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1413412C293E19564FBF35A316ABA4A649271BC427130CE5F62448ACC7C3B7429D2336F
sha3_384: cd8f8bed545678df855ff8c9f4475e4e3866f1c5ca198fd3ec57b633ae9d7229707ce197149b70850fcd35648dc870db
ep_bytes: 832d00f041000173068b0504f0410083
timestamp: 1992-06-19 22:22:17

Version Info:
0: [No Data]

Win32/TrojanDownloader.FakeAlert.BGV also known as:

How to remove Win32/TrojanDownloader.FakeAlert.BGV?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.