Win32:FakeAV-DUA [Trj] removal tips

The Win32:FakeAV-DUA [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:FakeAV-DUA [Trj] virus can do?

The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Win32:FakeAV-DUA [Trj]?


File Info:
name: BB8EC9986CEAC9278F2F.mlw
path: /opt/CAPEv2/storage/binaries/94608b5de0e0f1f6d9f858dc51b5dd2d90dd2577d890a0ffcd054e39ad22e681
crc32: C81DD86A
md5: bb8ec9986ceac9278f2fe5dc901510d4
sha1: de5a292e382cea88f58867fd4dc5c78392f68c82
sha256: 94608b5de0e0f1f6d9f858dc51b5dd2d90dd2577d890a0ffcd054e39ad22e681
sha512: 0ea9500705bdf9505b8989642bd06d9f84951e7071728dc428c6b9a8d0d3bd1d2763498738c8907cb4f89570d8bf1ef7662f52b0421b4495e0dd460ea192fc1f
ssdeep: 1536:40RJYiCkEBBTw1XBWfMR5wnxffsc2bDrQjeFvpGEC4MHOsHLOWYvZICqBM9b:nXPE3TwnYMixffKsaZ44MHOsrry9b
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B7A3BF11EB83C06ADDC2D1FAD6AA873FA9281F31031510D7EFE4AF9A17740D2BA31556
sha3_384: 0e015cbf88a22b8f618ad3d599f76f1b1ba173d374ce40085ecf1d704526cea9dcbdac8bc9f6385ab81dada9119c9e98
ep_bytes: 558bec6aff68e8bb430068d828400064
timestamp: 2012-08-09 13:27:20

Version Info:
0: [No Data]

Win32:FakeAV-DUA [Trj] also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.SmartFortress2012.lAJO
Elastic	malicious (high confidence)
DrWeb	Trojan.Fakealert.32747
FireEye	Generic.mg.bb8ec9986ceac927
CAT-QuickHeal	FraudTool.Security
McAfee	PWS-Zbot.gen.akj
VIPRE	Trojan.Win32.Winwebsec.ma (v)
Sangfor	Trojan.Win32.Agent.WGDBFC
Alibaba	TrojanPSW:Win32/FakeAV.a124d18e
Cybereason	malicious.e382ce
Symantec	Trojan.Gen.MBT
TrendMicro-HouseCall	TROJ_GEN.R002C0PB822
NANO-Antivirus	Trojan.Win32.FakeAv.dgosbb
Avast	Win32:FakeAV-DUA [Trj]
Comodo	TrojWare.Win32.Kryptik.AJPQ@4q3n6n
Baidu	Win32.Trojan.Kryptik.od
Zillya	Trojan.FakeAV.Win32.217955
TrendMicro	TROJ_GEN.R002C0PB822
McAfee-GW-Edition	BehavesLike.Win32.ZBot.nh
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.FakeAV
Jiangmin	Trojan/SmartFortress2012.bzg
Antiy-AVL	Trojan/Generic.ASMalwS.A6273
Gridinsoft	Ransom.Win32.Zbot.sa
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
ViRobot	Trojan.Win32.A.SmartFortress2012.454656.A
GData	Win32.Trojan.Agent.WGDBFC
Cynet	Malicious (score: 100)
APEX	Malicious
Rising	Malware.XPACK!1.64E8 (CLOUD)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Zbot.AKJ!tr.pws
AVG	Win32:FakeAV-DUA [Trj]
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Win32:FakeAV-DUA [Trj]?

Win32:FakeAV-DUA [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X