Mal/VB-A removal guide

The Mal/VB-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Mal/VB-A virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Mal/VB-A?

File Info:
name: A857F57C84EC66BCAB61.mlw
path: /opt/CAPEv2/storage/binaries/e653440ac8d1eb8fb0f6e672bf2f388dfc1d07dc624597813df1f9086a939573
crc32: 1BF14513
md5: a857f57c84ec66bcab6192ea23bdae9d
sha1: 0a892fdc046f4e1bb1f79a9ffd28d785618f62e1
sha256: e653440ac8d1eb8fb0f6e672bf2f388dfc1d07dc624597813df1f9086a939573
sha512: 5068cfd537de9d1eadeffcf8dfcec17982265e51ffa1d97c5dda115ad5c033710d32f953a0e4dc269085296fbe2bcebafddf54feaea0a7f6b907d3dcdac4a09c
ssdeep: 12288:/o5UAbHhyCk5wffHm6hvhr+skq2DB2WBqPHm4Fm+myQ77+ZIgwlR/1yrao:/o5fbHMeffr5hCskqWB2SqPHfJm4OP/B
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T182E423653A50F2CEF8F076FA3049D0E62AA2BE614D5C667B715AFF0FBC35568C4804A1
sha3_384: b7248eb435ec96097ea964a2d557247486cb78cf3ee5c131f4c107b05361a3e45b2d00395f1c1626d96233a9358ab238
ep_bytes: 60be00f053008dbe0020ecff5783cdff
timestamp: 2020-05-30 19:13:55

Version Info:
Translation: 0x0410 0x04b0
CompanyName: ND
ProductName: DExplorer
FileVersion: 1.01.0085
ProductVersion: 1.01.0085
InternalName: DExplorer
OriginalFilename: DExplorer.exe

Mal/VB-A also known as:

How to remove Mal/VB-A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.