What is "ML/PE-A + Troj/Wonton-IZ"?

The ML/PE-A + Troj/Wonton-IZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/Wonton-IZ virus can do?

Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine ML/PE-A + Troj/Wonton-IZ?


File Info:
crc32: 8B480E86
md5: b520b4ab00abb96c164117108dbc6490
name: B520B4AB00ABB96C164117108DBC6490.mlw
sha1: b0dfae3df25f0c80dd8e5305e1bbf3ee647f521b
sha256: d27c4a9d19a7b796deb4f34f20d11aef7206c1eb16a1c62037d8b949ca8c56ab
sha512: 968f283e24184ccea842d53e142dadd741446d59d698a71c2bcb8a8d594d93c47b575c5f93e8eeb5676e3ad5fd407afcc54a6411db413cea7a387dffec214747
ssdeep: 12288:Jcas3rYlCUwKSLQGYt25Wdhg9cgGI0QJrFI3+:J3KrYLSTYt2Adhg9c7I0QJrFI3+
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) DynamoRIO developers 2003-2008
InternalName: drconfig.exe
FileVersion: 6,2,0,2
CompanyName: DynamoRIO developers
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: DynamoRIO
SpecialBuild: 
ProductVersion: 6,2,0,2
FileDescription: DynamoRIO configuration command-line utility
OriginalFilename: drconfig.exe
Translation: 0x0409 0x04b0

ML/PE-A + Troj/Wonton-IZ also known as:

MicroWorld-eScan	Trojan.GenericKD.45673107
FireEye	Generic.mg.b520b4ab00abb96c
CAT-QuickHeal	PUA.WacapewPMF.S18135453
Qihoo-360	Win32/Virus.Peviru.HxMBCNoA
McAfee	Artemis!B520B4AB00AB
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Virus_Suspicious.Win32.Sality.ae
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Trojan.GenericKD.45673107
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.df25f0
Cyren	W32/Trojan.FVS.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Triusor-6793886-0
Kaspersky	HEUR:Exploit.Win32.ShellCode.vho
Alibaba	Exploit:Win32/ShellCode.c8be9a4d
NANO-Antivirus	Virus.Win32.Gen.ccmw
Rising	Trojan.Kryptik!1.D245 (CLASSIC)
Ad-Aware	Trojan.GenericKD.45673107
Emsisoft	Trojan.GenericKD.45673107 (B)
F-Secure	Trojan.TR/Redcap.tafkw
Zillya	Exploit.Shellcode.Win32.4
TrendMicro	TROJ_GEN.R002C0RB321
McAfee-GW-Edition	BehavesLike.Win32.Infected.jh
Sophos	ML/PE-A + Troj/Wonton-IZ
Ikarus	Exploit.Shell
Jiangmin	Packed.Krap.gtnb
Avira	TR/Redcap.tafkw
Antiy-AVL	Trojan[Exploit]/Win32.ShellCode
Microsoft	Trojan:Win32/Tiggre!rfn
Gridinsoft	Trojan.Win32.Downloader.oa
Arcabit	Trojan.Generic.D2B8EA93
ZoneAlarm	HEUR:Exploit.Win32.ShellCode.vho
GData	Trojan.GenericKD.45673107
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Gen.Reputation.C4321688
MAX	malware (ai score=83)
Malwarebytes	Malware.Heuristic.1004
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0RB321
Tencent	Win32.Exploit.Shellcode.Pdbs
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Krap.IU!tr
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)

How to remove ML/PE-A + Troj/Wonton-IZ?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

What is “ML/PE-A + Troj/Wonton-IZ”?