Trojan:Win32/Peglegmorb.A removal

The Trojan:Win32/Peglegmorb.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Peglegmorb.A virus can do?

The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Network activity detected but not expressed in API logs

How to determine Trojan:Win32/Peglegmorb.A?


File Info:
crc32: 22E9F999
md5: 894a02cb39ba76fa795d5cda706de447
name: 894A02CB39BA76FA795D5CDA706DE447.mlw
sha1: c16e9b85ae5966108422b91a1fb51000f37af734
sha256: e9e9fbd755a1554e8867ea6002cc857bb462e59717a4cc09f3899d703a9f72dc
sha512: d4a7b1bbc9f238a6654822bf9c7de2ebe9de0377881a8639e4bc71f7b6919c98d983ec0ca4cc1f87f06dabaec95a7e2243b27b31c67b8bd5a4e5de9ed538ea47
ssdeep: 384:P+DJbgPMniTRo54i52n6+jIyTGkdDtNZdDLF:CJUokoqi5UjHnJ
type: PE32 executable (console) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: Copyright (C) 2009-2016, Ivo Beltchev
InternalName: ClassicShellSetup
FileVersion: 4, 3, 0, 0
CompanyName: IvoSoft
ProductName: Classic Shell
ProductVersion: 4, 3, 0, 0
FileDescription: Adds classic shell features to Windows 7 and Windows 8
OriginalFilename: ClassicShellSetup.exe
Translation: 0x0409 0x04b0

Trojan:Win32/Peglegmorb.A also known as:

K7AntiVirus	Trojan ( 004f57261 )
Lionic	Trojan.Win32.DiskWriter.4!c
CAT-QuickHeal	Ransom.Peglegmorb.A13
Cylance	Unsafe
K7GW	Trojan ( 004f57261 )
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/KillMBR.NDO
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan.Win32.DiskWriter.hy
NANO-Antivirus	Trojan.Win32.DiskWriter.ehypij
Tencent	Malware.Win32.Gencirc.114ba602
Sophos	Troj/DiskKill-B
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Trojan.Win32.KILLMBR.SM
McAfee-GW-Edition	BehavesLike.Win32.Generic.mm
Jiangmin	Trojan.DiskWriter.ab
Avira	BOO/Peglegmorb.A
Antiy-AVL	Trojan/Generic.ASMalwS.1C2A5B8
Kingsoft	Win32.Troj.DiskWriter.hy.(kcloud)
Microsoft	Trojan:Win32/Peglegmorb.A
McAfee	Artemis!894A02CB39BA
VBA32	BScope.Trojan.DiskWriter
Panda	Trj/CI.A
TrendMicro-HouseCall	Trojan.Win32.KILLMBR.SM
Yandex	Trojan.DiskWriter!VoyFfs9PKBs
Ikarus	Trojan.Win32.KillMBR
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/KillMBR.NBQ!tr
AVG	Win32:Malware-gen

How to remove Trojan:Win32/Peglegmorb.A?

Trojan:Win32/Peglegmorb.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X