ML/PE-A + Mal/FauxMS-I removal instruction

The ML/PE-A + Mal/FauxMS-I is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What ML/PE-A + Mal/FauxMS-I virus can do?

Sample contains Overlay data
Authenticode signature is invalid

How to determine ML/PE-A + Mal/FauxMS-I?


File Info:
name: A694BF56B79D2411EDB3.mlw
path: /opt/CAPEv2/storage/binaries/06648e683026bdb861d9f56e5c434d74b2bf74363bd80a7643836d74e6afef31
crc32: F9F3FD82
md5: a694bf56b79d2411edb3b88e50b62857
sha1: 0bb29cdda73fe0c5262fecb6b07892cad4fb27d3
sha256: 06648e683026bdb861d9f56e5c434d74b2bf74363bd80a7643836d74e6afef31
sha512: 9823e61d03abb9eda8290317132c035f419444072c1cccd63e53e113fe13c737577da7dc6d794ef84dbd13193f24063f722ad55bb7cf961945f7e35bfd02062c
ssdeep: 6144:chbBYnyVuFFaRXuxLqhmprRFUCy7eia/KH1D4:ObGnyV40uVqhm5RFUC1O
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T177544C223EE4C433E6A205718DF967B4B5B6FD244E314C0723857B5D1E36992E622B2F
sha3_384: 87b3cc43d705fcbe13e5d0d3070c96fbfef5a88c4e535815cf3d96a8f45a62410685bacac725bd0dc48056a32e1adf06
ep_bytes: 80d69119fa8af3f6d590b85c42000090
timestamp: 2003-03-07 14:04:53

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Microsoft Corporation
FileDescription: Service Manager
LegalCopyright: Copyright (C) Microsoft Corp. 1991-1998
ProductName: Service Manager
FileVersion: 4.90.3000
ProductVersion: 4.90.3000
InternalName: SERVICEMGR
OriginalFilename: SERVICEMGR.EXE

ML/PE-A + Mal/FauxMS-I also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Win32.Virtob.Gen.12
FireEye	Generic.mg.a694bf56b79d2411
CAT-QuickHeal	W32.Virut.G
McAfee	W32/Passma.worm.c
Cylance	Unsafe
VIPRE	Win32.Virtob.Gen.12
Sangfor	Suspicious.Win32.Save.vb
K7AntiVirus	Trojan ( 004cc9d91 )
K7GW	Trojan ( 004cc9d91 )
Cybereason	malicious.6b79d2
BitDefenderTheta	AI:FileInfector.C9457D4313
VirIT	Win32.Scribble.A
Cyren	W32/VB.HV.gen!Eldorado
Symantec	SMG.Heur!gen
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/PassMa.NAB
Baidu	Win32.Worm.PassMa.d
TrendMicro-HouseCall	PE_VIRUX.A-1
ClamAV	Win.Trojan.Passmail-1
Kaspersky	Worm.Win32.WBNA.roc
BitDefender	Win32.Virtob.Gen.12
NANO-Antivirus	Virus.Win32.Virut.hpeg
Cynet	Malicious (score: 100)
SUPERAntiSpyware	Trojan.Agent/Gen-Passma
Avast	Win32:Vitro [Inf]
Tencent	Malware.Win32.Gencirc.10b0b071
Ad-Aware	Win32.Virtob.Gen.12
Emsisoft	Win32.Virtob.Gen.12 (B)
Comodo	Worm.Win32.PassMa.~B@ti3hg
DrWeb	BackDoor.Generic.694
Zillya	Worm.WBNA.Win32.1132570
TrendMicro	PE_VIRUX.A-1
McAfee-GW-Edition	W32/Passma.worm.c
SentinelOne	Static AI – Malicious PE
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A + Mal/FauxMS-I
APEX	Malicious
GData	Win32.Virtob.Gen.12
Avira	W32/Passma
MAX	malware (ai score=87)
Arcabit	Win32.Virtob.Gen.12
Microsoft	Trojan:Win32/Sabsik.TE.B!ml
Google	Detected
Acronis	suspicious
Malwarebytes	Worm.Agent
Rising	Worm.Passma (CLASSIC)
Ikarus	Worm.Win32.Passma
MaxSecure	Virus.Virut.CE
Fortinet	W32/Virut.CE
AVG	Win32:Vitro [Inf]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (W)

How to remove ML/PE-A + Mal/FauxMS-I?

ML/PE-A + Mal/FauxMS-I removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X