ML/PE-A + Mal/ZboCheMan-L removal tips

The ML/PE-A + Mal/ZboCheMan-L is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Mal/ZboCheMan-L virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Spoofs its process name and/or associated pathname to appear as a legitimate process

How to determine ML/PE-A + Mal/ZboCheMan-L?

File Info:
name: F73FABBD2278463D0E4D.mlw
path: /opt/CAPEv2/storage/binaries/313dee60b2947ee682173e56e1d3fb3d686047420dbdb0e964cc2bd392883115
crc32: F2C325FE
md5: f73fabbd2278463d0e4d7e3401a0398b
sha1: 2e9db45d7f7f147129259dc1386a60bc2c738339
sha256: 313dee60b2947ee682173e56e1d3fb3d686047420dbdb0e964cc2bd392883115
sha512: 583eb33e1607c61915bc8fbf7b1767651ab09911c49a2b0bba322448c7490e60346f4be10481cb2e9ca2cdc8e6c9d2458514c677d6422b81db680a766342d671
ssdeep: 6144:9VlWOtrxzo2GscpX8KVNHRc7tYf6MSeY1tzd:9VZrxZuWS54U6iY1X
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16B44028B49E4D372C9810BB25F31E4C6CD6BD60A4720C2A3F7D1985839BE7B14E2597B
sha3_384: 8e179d13b7caef02f61efdf4490b14f228b42abb8cdd768e6a9484d1732ed983e23fe820c642df9775348c8a297ea63d
ep_bytes: 68a400000068000000006828af4000e8
timestamp: 2012-12-18 17:33:38

Version Info:
0: [No Data]

ML/PE-A + Mal/ZboCheMan-L also known as:

How to remove ML/PE-A + Mal/ZboCheMan-L?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.