ML/PE-A + Troj/Zbot-FHX information

The ML/PE-A + Troj/Zbot-FHX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + Troj/Zbot-FHX virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Venda
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine ML/PE-A + Troj/Zbot-FHX?

File Info:
name: 000DDAB31A3AB1A22221.mlw
path: /opt/CAPEv2/storage/binaries/64d39c7553757c3ac440c3b8a617aae90211e75f0b94efe57e1fe06a1849e97c
crc32: 0808EDC3
md5: 000ddab31a3ab1a22221ca542e881c61
sha1: ffbc3258563621f91be074d7f0985a67057e511a
sha256: 64d39c7553757c3ac440c3b8a617aae90211e75f0b94efe57e1fe06a1849e97c
sha512: a71bb985e595903c1c5f0cb133b3004dac02fabd167486e76fb88a4961ef2d02656032d728d15ef721a3b195beb3d85737eeeb149a85de828bb3d0368cb72367
ssdeep: 6144:VXTCR/2IMqtw8OTEqD0TqBz7G6+MBMwga8iEVLP:Q7w82EqD0WJ7G6+oD8xLP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C754BFC2735891B9C47ACD70DDD5E4B77AA6CE6393C850F66F6A24C4D33082A9A20F4D
sha3_384: d555284afe592ca5a6aa64c45d35a6daedf2d3a503023310fe8a14867acfbc141bce13accce146284651d27795862686
ep_bytes: 535ab801000000e8000000005b83eb0c
timestamp: 2013-05-19 23:24:01

Version Info:
Coder: NEOx 
Comments: Cool PE Editor !!!
CompanyName: Underground InformatioN Center
Credits: NiFi, Dr.Golova, SOLDIER, Corbio, Rook, SUnteXx, V.Vilman, JFX, dum0h, .Cryorb, Volodya, spEctoRius, cyberbob, FEUERRADER, .::D.e.M.o.N.i.X::., dyn!o, Bad_guy, Aster!x, lepton, ...
FileDescription: PE Tools v1.5 Xmas Edition
FileVersion: 1.5.400.2003
InternalName: PE Tools v1.5 Xmas Edition
LegalCopyright: Copyright © 2003 Underground InformatioN Center
LegalTrademarks: PE Tools v1.5 Xmas Edition
OriginalFilename: PETools.exe
PrivateBuild: Public version
ProductName: PE Tools v1.5 Xmas Edition
ProductVersion: 1.5.400.2003
SpecialBuild: Visit http://www.uinc.ru/ for updates.
Translation: 0x0409 0x04b0

ML/PE-A + Troj/Zbot-FHX also known as:

How to remove ML/PE-A + Troj/Zbot-FHX?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.