ML/PE-A + ATK/Shellter-AC removal guide

The ML/PE-A + ATK/Shellter-AC is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What ML/PE-A + ATK/Shellter-AC virus can do?

Executable code extraction
Creates RWX memory
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)

How to determine ML/PE-A + ATK/Shellter-AC?


File Info:
crc32: CFD6A766
md5: 17f495320503f62882dbdc86bb0683cb
name: 17F495320503F62882DBDC86BB0683CB.mlw
sha1: 594f4d64ea88bf15c5ff36e97bbeeb382d7710b6
sha256: f40bfcb006d00322cf40418f6d49804a62886d4282551f512e90d709cf05a0b3
sha512: 9af314d3da4ef6b6aacb1a6d20d87a8d583cbb520c93af0c44b6f83eeeb9590f690dce2c227644c5a8ed5a5e97c7fef33acd1e8bda1ed5f51bee5482b2f745f1
ssdeep: 1536:vwuuNQKLjWDyy1o5I0hJUEbooPRrKKRRySjVi/7a:iNQKPWDyDI0hJltZrpRRysVi/
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: (C) Microsoft Corporation. All rights reserved.
InternalName: Notepad
FileVersion: 5.1.2600.5512 (xpsp.080413-2105)
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Windows(R) Operating System
ProductVersion: 5.1.2600.5512
FileDescription: x8bb0x4e8bx672c
OriginalFilename: NOTEPAD.EXE
Translation: 0x0804 0x04b0

ML/PE-A + ATK/Shellter-AC also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
ALYac	Gen:Heur.Mint.Zard.24
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Cybereason	malicious.20503f
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	FileRepMalware
Kaspersky	Packed.Win32.Katusha.o
BitDefender	Gen:Heur.Mint.Zard.24
MicroWorld-eScan	Gen:Heur.Mint.Zard.24
Tencent	Win32.Packed.Katusha.Ebhk
Ad-Aware	Gen:Heur.Mint.Zard.24
Sophos	ML/PE-A + ATK/Shellter-AC
TrendMicro	Backdoor.Win32.SWRORT.SMB
McAfee-GW-Edition	MalHeur-FAG!17F495320503
FireEye	Generic.mg.17f495320503f628
Emsisoft	Gen:Heur.Mint.Zard.24 (B)
Avira	HEUR/AGEN.1124598
Microsoft	Trojan:Win32/Swrort.A
ZoneAlarm	Packed.Win32.Katusha.o
GData	Gen:Heur.Mint.Zard.24
AhnLab-V3	Packed/Win32.RL_Katusha.R361750
McAfee	MalHeur-FAG!17F495320503
MAX	malware (ai score=82)
VBA32	BScope.Trojan.Swrort
TrendMicro-HouseCall	Backdoor.Win32.SWRORT.SMB
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazpISwfZ4o+G13ymJRqcWPg4)
Ikarus	Trojan.Win32.Dialer
Fortinet	W32/Generic.AC.3A1D4B!tr
AVG	FileRepMalware
Paloalto	generic.ml
Qihoo-360	HEUR/QVM08.0.A84F.Malware.Gen

How to remove ML/PE-A + ATK/Shellter-AC?

ML/PE-A + ATK/Shellter-AC removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X