ML/PE-A + Troj/FakeAV-CSI information

The ML/PE-A + Troj/FakeAV-CSI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/FakeAV-CSI virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine ML/PE-A + Troj/FakeAV-CSI?

File Info:
name: 97D63A05C287718B4ACE.mlw
path: /opt/CAPEv2/storage/binaries/0d776893ef2acd1de6680cdea54ef62e431d5d36da1ff2712934112e50ff3db8
crc32: 40740431
md5: 97d63a05c287718b4ace85615257c887
sha1: 3d00ba3c9c817b66ccb2061bffcf93dfb33719c9
sha256: 0d776893ef2acd1de6680cdea54ef62e431d5d36da1ff2712934112e50ff3db8
sha512: 6972b968c7d36d0c0f928cc4a8ef8804797c9b6c95c693c3b13cac684f581ee7c83d11d2f1544cee6cabfb9b595c786fb3782f998afb69cd8c297058885e94eb
ssdeep: 3072:I+yM2SHCXzagvJKj1NvrJ4JoIc0pp6yjTz+qY/KSzr1ndeEcT:lFHezagv8JbIc0pEsuuSzJ8
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14CD31248B7E7193FD6655B71A8C4B303127AF98DA6810F110C48D0897CE2B897BBE65F
sha3_384: 487e6ca2eb2dc8765fd4cd437498727db2440b196458dbf0994a62d395cf297221129b2b24bb024be777279e327c72dc
ep_bytes: 60be003042008dbe00e0fdff57eb0b90
timestamp: 2008-10-15 11:55:35

Version Info:
CompanyName: AVG Technologies CZ, s.r.o.
FileDescription: AVG Tray Monitor
FileVersion: 9.0.0.871
InternalName: avgtray
LegalCopyright: Copyright © 2010 AVG Technologies CZ, s.r.o.
OriginalFilename: avgtray.exe
ProductName: AVG Internet Security
ProductVersion: 9.0.0.871
PrivateBuild: Win32 Release_Unicode
SpecialBuild: Avg8VC8_2010_1109_133319(871), SVNRev 145063 (/branches/release/SmallUpdate9-12)
Translation: 0x0409 0x04e4

ML/PE-A + Troj/FakeAV-CSI also known as:

How to remove ML/PE-A + Troj/FakeAV-CSI?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.