Should I remove “ML/PE-A + Troj/Agent-BBUL”?

The ML/PE-A + Troj/Agent-BBUL is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What ML/PE-A + Troj/Agent-BBUL virus can do?

Presents an Authenticode digital signature
Anomalous binary characteristics

How to determine ML/PE-A + Troj/Agent-BBUL?


File Info:
crc32: 55ED1C4E
md5: f239d0c462e3fff4ab07146dc0fc4b40
name: F239D0C462E3FFF4AB07146DC0FC4B40.mlw
sha1: 2b0d86cfa8f414419ab8908491b7bbaf2de16de8
sha256: 88aeb860922b1426a72c732956eb8339aa13089b93576db5b3f38a708ad25653
sha512: e2c826a1e3ff270db10ac29b194ef53160afaac71eca7b2a6171305e741c64c1dda793aa4d5d37bf90beeaaeda8da74332e19e4d4786569cc09a3b0410969ff3
ssdeep: 12288:bRzSCRL7aQEwhT94ZDEpUE9QDV9U11Sv+kjxo8ISXgJW7jxo8ISxDEpUE9QDV9Up:wCcSO4Av+V8tgJd8GAUw/rG
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 2006 Microsoft Corporation. All rights reserved.
Assembly Version: 3.0.0.0
InternalName: PerformanceCounterInstaller.exe
FileVersion: 3.0.4203.835
CompanyName: Microsoft Corporation
LegalTrademarks: Microsoftxae is a registered trademark of Microsoft Corporation. Windowsxae is a registered trademark of Microsoft Corporation.
ProductName: Windows Workflow Foundation
ProductVersion: 3.0.4203.835
FileDescription:  
OriginalFilename: PerformanceCounterInstaller.exe

ML/PE-A + Troj/Agent-BBUL also known as:

K7AntiVirus	Trojan ( 00577f0b1 )
Elastic	malicious (high confidence)
DrWeb	Win32.HLLW.Autoruner.547
Cynet	Malicious (score: 100)
ALYac	Trojan.GenericKD.36881047
Cylance	Unsafe
Sangfor	Worm.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
Alibaba	Virus:Win32/VB.609cdda0
K7GW	Trojan ( 00577f0b1 )
Cybereason	malicious.462e3f
Baidu	Win32.Trojan.VB.t
Cyren	W32/MSIL_Agent.EK.gen!Eldorado
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/VB.NAR
APEX	Malicious
Avast	Win32:VB-FBX
ClamAV	Win.Malware.Kolab-6803326-0
BitDefender	Trojan.GenericKD.36881047
MicroWorld-eScan	Trojan.GenericKD.36881047
Ad-Aware	Trojan.GenericKD.36881047
Sophos	ML/PE-A + Troj/Agent-BBUL
Comodo	Malware@#3bbwueaym5ro5
BitDefenderTheta	Gen:NN.ZemsilF.34236.ho3@aOHa@Ei
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0RF221
McAfee-GW-Edition	BehavesLike.Win32.Autorun.vm
FireEye	Generic.mg.f239d0c462e3fff4
Emsisoft	Trojan.GenericKD.36881047 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan/Generic.ASBOL.C595
Microsoft	Trojan:Win32/Wacatac.B!ml
GData	Trojan.GenericKD.36881047
McAfee	Artemis!F239D0C462E3
MAX	malware (ai score=86)
TrendMicro-HouseCall	TROJ_GEN.R002C0RF221
Ikarus	Trojan.Dropper
MaxSecure	Trojan.Malware.117911254.susgen
Fortinet	MSIL/Agent.164E!tr
AVG	Win32:VB-FBX

How to remove ML/PE-A + Troj/Agent-BBUL?

ML/PE-A + Troj/Agent-BBUL removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X