About “ML/PE-A + Troj/VB-KVR” infection

The ML/PE-A + Troj/VB-KVR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/VB-KVR virus can do?

• Executable code extraction
• Attempts to connect to a dead IP:Port (1 unique times)
• A process attempted to delay the analysis task.
• Expresses interest in specific running processes
• Reads data out of its own binary image
• Drops a binary and executes it
• Enumerates services, possibly for anti-virtualization
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Mimics the file times of a Windows system file
• Installs itself for autorun at Windows startup
• Creates a hidden or system file
• Creates a slightly modified copy of itself
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed

Related domains:

How to determine ML/PE-A + Troj/VB-KVR?

File Info:
crc32: C77C9EE2
md5: 47ab806c317f5fc26bcfb139ac7377ff
name: 47AB806C317F5FC26BCFB139AC7377FF.mlw
sha1: 6ce834213b647241d3c2b66eccee649c60e650b9
sha256: 828fc25150ddf1b8828bb93962793a68fe8b2747b1d07bd01383261cbd5deafb
sha512: c72a05cb1fffe117b4865728f333695d69cce2b9f937d87d47fbcbc73beaa8ce4030bc4d5b2d90f91164eefc3b26ca99d148d3eb2584a443372f0d2a2fe7893a
ssdeep: 1536:Sbxaa7vst+SbtS0SIImNMlsCSZxIG+UkHoVbCjqDO:8vzRfloVbA4
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0409 0x04b0
InternalName: z5HjjfZ
FileVersion: 8.10
CompanyName: UserXP
ProductName: 932HjjfZ
ProductVersion: 8.10
OriginalFilename: z5HjjfZ.exe

ML/PE-A + Troj/VB-KVR also known as:

How to remove ML/PE-A + Troj/VB-KVR?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.