How to remove “Win32:FakeAV-DZQ [Trj]”?

The Win32:FakeAV-DZQ [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:FakeAV-DZQ [Trj] virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32:FakeAV-DZQ [Trj]?


File Info:
name: C02A120034AF3108490C.mlw
path: /opt/CAPEv2/storage/binaries/004e7f6413640fa04a35c8bd56b0162f26512520ed77c168902114c54b204fdd
crc32: A0A03EC7
md5: c02a120034af3108490cb8bf198cfcc4
sha1: 0a4c51c3beeb0a8a76d81cf6a533d5fef6b8b10e
sha256: 004e7f6413640fa04a35c8bd56b0162f26512520ed77c168902114c54b204fdd
sha512: 0867ecbb2b2288df61c46e2793ddcae3771fc80e29c52a250b32faa1d5837b3d3ed7df98a4be4c03b4b9fa3d2cd956bdad05277178c731f11a9d0443f76df99b
ssdeep: 12288:PWxLWIh/hx0ekZGuI6EeVAgsWCgAP71FXla1+fjLW0EFux:PYWI36zGUEWAgsRfjPm+7C0E
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T162158C323661F03BC1960279927742F5FB3C7B312E29340F57C66B6E2AB0691E971396
sha3_384: d340dfbf18932bc50a833b8677a9dd8b3e8a0b8f535f14fc774cdd1b5e048761514c28409e4c091f8b2287197d5fadb6
ep_bytes: f40fb651f42bf2740f33d285f60f9fc2
timestamp: 2013-04-05 12:10:42

Version Info:
0: [No Data]

Win32:FakeAV-DZQ [Trj] also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
Skyhigh	BehavesLike.Win32.Generic.dc
Malwarebytes	SystemSecurity.Trojan.Rogue.DDS
Sangfor	Virus.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
Symantec	ML.Attribute.HighConfidence
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Trojan.Winwebsec-9956641-0
Avast	Win32:FakeAV-DZQ [Trj]
F-Secure	Trojan.TR/Crypt.XPACK.Gen2
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.c02a120034af3108
Sophos	Generic ML PUA (PUA)
SentinelOne	Static AI – Malicious PE
Avira	TR/Crypt.XPACK.Gen2
Antiy-AVL	Trojan[Rogue]/Win32.Winwebsec
Kingsoft	malware.kb.a.1000
Microsoft	Trojan:Win32/Wacatac.B!ml
Google	Detected
Cylance	unsafe
Rising	Rogue.Winwebsec!1.6516 (CLASSIC)
Ikarus	Trojan.Win32.FakeAV
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:FakeAV-DZQ [Trj]
Cybereason	malicious.3beeb0
DeepInstinct	MALICIOUS

How to remove Win32:FakeAV-DZQ [Trj]?

Win32:FakeAV-DZQ [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X