PUABundler:Win32/MSetup removal tips

The PUABundler:Win32/MSetup is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PUABundler:Win32/MSetup virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Anomalous binary characteristics

How to determine PUABundler:Win32/MSetup?


File Info:
name: C8B1B4F6C36ED8097D0A.mlw
path: /opt/CAPEv2/storage/binaries/dd4c74414edb139683879d6631cb698d1f481ce4863eadd44a1733f3c40838ec
crc32: 07ABD17C
md5: c8b1b4f6c36ed8097d0afba5cbff32de
sha1: f26354e9a446f4c5a0d102a381616e99cdf62012
sha256: dd4c74414edb139683879d6631cb698d1f481ce4863eadd44a1733f3c40838ec
sha512: 6af3bc2b631ef1ad1d69e730631e782034d37e574d86376cdf8a53e88ef2c399b02debb5e829e85f5e1e5cfb3ab0f043c68adea41be4df54dc37b116a5e454a4
ssdeep: 12288:2FGi/O96l5p1hgTOPrGYDfJtW7C8z2eYFKYKOQKQ95uEPZugy:2FxOY5p1+ydfGCKOQKoE
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B5F4AE12BCA080B3E262117099FD8F739A7DAA74533169D343D45D346A30BE2E63677E
sha3_384: 38f8a9703dd593017bc289b00911f3142131180576a61ef7e1d288cf1d340ad4fd545058c8899a1e99831880d765e341
ep_bytes: e87f0b0000e97afeffff3b0d44804c00
timestamp: 2023-09-21 08:00:29

Version Info:
0: [No Data]

PUABundler:Win32/MSetup also known as:

Bkav	W32.AIDetectMalware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.bh
McAfee	PUP-XVW-PF
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Trojan.GenericKDZ.103080
Arcabit	Trojan.Generic.D192A8
ESET-NOD32	a variant of Win32/MSetupDownloader.A potentially unwanted
Kaspersky	not-a-virus:HEUR:Downloader.Win32.MPCrow.gen
BitDefender	Trojan.GenericKDZ.103080
MicroWorld-eScan	Trojan.GenericKDZ.103080
Emsisoft	Trojan.GenericKDZ.103080 (B)
FireEye	Trojan.GenericKDZ.103080
Ikarus	PUA.MSetupDownloader
Jiangmin	Downloader.MPCrow.k
Varist	W32/Kryptik.LJF.gen!Eldorado
Antiy-AVL	Trojan/Win32.Agent
Microsoft	PUABundler:Win32/MSetup
ZoneAlarm	not-a-virus:HEUR:Downloader.Win32.MPCrow.gen
GData	Trojan.GenericKDZ.103080
Google	Detected
ALYac	Trojan.GenericKDZ.103080
MAX	malware (ai score=83)
Rising	Trojan.Generic@AI.100 (RDML:TcUeBoROcLpa7EPNpJmRDA)
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	Riskware/MSetupDownloader
CrowdStrike	win/grayware_confidence_90% (D)

How to remove PUABundler:Win32/MSetup?

PUABundler:Win32/MSetup removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X