ML/PE-A + W32/Fakefire-A removal instruction

The ML/PE-A + W32/Fakefire-A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What ML/PE-A + W32/Fakefire-A virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Manipulates data from or to the Recycle Bin
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• Executable file is packed/obfuscated with ASPack
• The binary likely contains encrypted or compressed data.
• Creates an autorun.inf file
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• Anomalous binary characteristics
• Unusual version info supplied for binary

How to determine ML/PE-A + W32/Fakefire-A?

File Info:
name: D2B99A665AAADEB87E9E.mlw
path: /opt/CAPEv2/storage/binaries/64f01cfc7cba82d5c1e699adac25690f77f1fcfb6dcd6234d7f9cb933ab334ef
crc32: FB15E5E5
md5: d2b99a665aaadeb87e9e6037f55230d5
sha1: c74f7cf35a13224bcf9c63ad1de079bfc52dfb42
sha256: 64f01cfc7cba82d5c1e699adac25690f77f1fcfb6dcd6234d7f9cb933ab334ef
sha512: b9f9d64a6d69f545f4b13f1fe2cd56120f1d25bc41ad2a403261fc242167667d5a6cb2539d29cb06cde5e64c2736a9c2c9ecc04ff43e29e115420b92e021c2b9
ssdeep: 49152:6eKrTWA0vbDv9M+ZqhaK6zbfqdlfkygitQMZgdeKVQkUbcom:PKuAO/9rxDygiod9J
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18AB59F11B7E140B9E177817549BA9326FA71BC211B30DECF1354AA395F32AC09B3A736
sha3_384: cdb0868ef7461fadcc1175fb542519cc4408c4852b25c718017c0b4ccb7f21e72c4b6e9761cffc520015109dbc0d7145
ep_bytes: 60e803000000e9eb045d4555c3e80100
timestamp: 2007-08-17 12:43:04

Version Info:
Translation: 0x0804 0x04b0
Comments: Microsoft Firewall
CompanyName: Xiang Corporation
FileDescription: Microsoft Firewall
LegalCopyright: Microsoft
LegalTrademarks: Microsoft Firewall
ProductName: Microsoft Firewall
FileVersion: 1.00.0007
ProductVersion: 1.00.0007
InternalName: Firewall
OriginalFilename: Firewall.exe

ML/PE-A + W32/Fakefire-A also known as:

How to remove ML/PE-A + W32/Fakefire-A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.