by malwarelabrobot on October 24th, 2013 in Malware Descriptions.

Gen:Variant.Strictor.4450 (BitDefender), Trojan.Win32.Generic!BT (VIPRE), Gen:Variant.Strictor.4450 (B) (Emsisoft), Artemis!A3ED09D61F76 (McAfee), Trojan.Win32.FakeAV (Ikarus), Gen:Variant.Strictor.4450 (FSecure)
Behaviour: Trojan, Fake-AV

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Technical Details
Removal Recommendations

MD5: a3ed09d61f7622ec506e12f967ae06ba
SHA1: 8ef1c7ea9876138faae41b5051d67f9b13b850ed
SHA256: 02f32ffb7d007bbe98cdc536900ca36152ee4ba6bb3e89113de232fd08c7810c
SSDeep: 49152:CWfWfWzWnWfW4zUODUtMjZUvGB0dJtZ02wH99PBJh0efw:CWfWfWzWnWfW449WZUvGB0d102wH99PW
Size: 2024960 bytes
File type: EXE
Platform: WIN32
Entropy: Packed
PEID: MicrosoftVisualC, NETexecutable, UPolyXv05_v6
Company: ExpressInstaller
Created at: 2013-02-12 04:06:08


Trojan. A program that appears to do one thing but actually does another (a.k.a. Trojan Horse).
Fake-AV. FakeAV programs generate exaggerated threat reports on the compromised computer then ask the user to purchase a registered version to remove those reported threats.


No specific payload has been found.

Process activity

The FakeAV creates the following process(es):


File activity

Registry activity

The process a3ed09d61f7622ec506e12f967ae06ba.exe:1664 makes changes in a system registry.
The FakeAV creates and/or sets the following values in system registry:

"Seed" = "31 20 CC 80 19 DB 41 B0 BC E4 D9 02 5A 3B 5B 0F"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"AppData" = "%Documents and Settings%\%current user%\Application Data"

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
"Cache" = "%Documents and Settings%\%current user%\Local Settings\Temporary Internet Files"

Network activity (URLs)

No activity has been detected.

Rootkit activity

No anomalies have been detected.


Remove it with Ad-Aware

  1. Click (here) to download and install Ad-Aware Free Antivirus.
  2. Update the definition files.
  3. Run a full scan of your computer.

Manual removal*

  1. Terminate the original FakeAV process (How to End a Process With the Task Manager).
  2. Delete the original Gen:Variant file.
  3. Reboot the computer.

*Manual removal may cause unexpected system behaviour and should be performed at your own risk.

No votes yet


Our best antivirus yet!

Fresh new look. Faster scanning. Better protection.

Enjoy unique new features, lightning fast scans and a simple yet beautiful new look in our best antivirus yet!

For a quicker, lighter and more secure experience, download the all new adaware antivirus 12 now!

Download adaware antivirus 12
No thanks, continue to
close x

Discover the new adaware antivirus 12

Our best antivirus yet

Download Now