Should I remove “Win32:Faker-S [Trj]”?

The Win32:Faker-S [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:Faker-S [Trj] virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32:Faker-S [Trj]?


File Info:
name: 78D6BF34C8D3211D3D26.mlw
path: /opt/CAPEv2/storage/binaries/fd69effa4e499b8f93e6312d15a299048957ae3b4a1a235797083a1587dc02be
crc32: 4FBCC03B
md5: 78d6bf34c8d3211d3d2671053574bb8f
sha1: 1d62516195aa163b81c893f4cc5c19849b534716
sha256: fd69effa4e499b8f93e6312d15a299048957ae3b4a1a235797083a1587dc02be
sha512: 22032db39838f2803cb5488dcabac3d4c78c4c2daf23d07b3be0b199cd1948fc119ff3ea5e521ff63d36491e33052439902978d98b90e2b2c6162f8ca3b35e81
ssdeep: 1536:YgYPhQXwIiPrrjThO+lUBrzCxry1ec7rUyj235EacAS2gV2kU+tqRKDw53JZ:zYP2XerzhOUxu/XUmacA/kjDtqRKDov
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T151E39D1732D1407AE5A2B2F06EBC3326D678BD3065B59106E771360EBA30293CD1AB1F
sha3_384: 15bb68edcb6a2f9a9297a75f1409fcf9cdf1428b66aca83c50bfa7f6e382ab99f7ebbccfda8daa730828c79e1aa32c19
ep_bytes: ff33048da86c41000fb64df98946080f
timestamp: 2010-03-15 06:27:50

Version Info:
0: [No Data]

Win32:Faker-S [Trj] also known as:

Bkav	W32.AIDetectMalware
Malwarebytes	Generic.Malware.AI.DDS
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Ransomware.Faker-6981068-0
Avast	Win32:Faker-S [Trj]
Zillya	Trojan.GenKryptik.Win32.57439
FireEye	Generic.mg.78d6bf34c8d3211d
Antiy-AVL	GrayWare/Win32.Wacapew
Microsoft	Program:Win32/Wacapew.C!ml
Google	Detected
Rising	Ransom.Agent!1.65AA (CLASSIC)
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Faker-S [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Win32:Faker-S [Trj]?

Win32:Faker-S [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X