PUA

Generic PUA DI (PUA) removal instruction

Malware Removal

The Generic PUA DI (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Generic PUA DI (PUA) virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Reads data out of its own binary image
  • Drops a binary and executes it
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Network activity contains more than one unique useragent.
  • Attempts to modify proxy settings
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
yz.app.sogou.com
a.tomx.xyz
ping.t.sogou.com
xz.sogou.com
yze.t.sogou.com

How to determine Generic PUA DI (PUA)?


File Info:

crc32: F2E5704F
md5: 5bfb4aa5d7eb51b2daa79bffd624af53
name: sogoubnfb.e
sha1: 38b1441d117249c3eeac9a133bda4b86f93e5e34
sha256: febadff91bf2d6afffec31f82e7985f5f500f962ab718acaa3fbf6b0809d8fed
sha512: 61b10c9bbb7c7074072fe7909f186f50fd0249f2c072df92490be31523d73e2146b65608602dfca0693ea495418b7d5be78ce5a892556e43b56f517e6c3e42a3
ssdeep: 49152:3uuE7AnqIxGrGYyZa/tgrYJUGfZC3wA6EylfwEaFWd:pE7AqrlyutLxC3sEwwMd
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: xa9 2014 Sogou.com Inc. All rights reserved.
InternalName: MiniDownLoad.exe
FileVersion: 3.1.12.94
CompanyName: Sogou.com Inc.
ProductName: x8f6fx4ef6x52a9x624b
ProductVersion: 3.1.12.94
FileDescription: x8f6fx4ef6x52a9x624b
OriginalFilename: MiniDownLoad.exe
Translation: 0x0804 0x04b0

Generic PUA DI (PUA) also known as:

BkavW32.HfsAdware.170E
CAT-QuickHealDownloader.Sogou
McAfeePUP-FTL
VIPRETrojan.Win32.Generic!BT
K7AntiVirusUnwanted-Program ( 004cca081 )
K7GWUnwanted-Program ( 004cca081 )
TrendMicroTROJ_GEN.R08NC0PCS17
BaiduWin32.Trojan.WisdomEyes.16070401.9500.9823
SymantecSMG.Heur!gen
TrendMicro-HouseCallTROJ_GEN.R08NC0PCS17
ClamAVWin.Worm.Chir-2282
Kasperskynot-a-virus:Downloader.Win32.Sogou.g
NANO-AntivirusTrojan.Win32.Sogou.dytxqq
AvastWin32:Malware-gen
SophosGeneric PUA DI (PUA)
ComodoApplication.Win32.Sogou.C
DrWebBackDoor.Gbot.2850
ZillyaDownloader.SogouCRTD.Win32.237
Invinceavirus.win32.parite.b
McAfee-GW-EditionPUP-FTL
EmsisoftApplication.Chindo (A)
SentinelOnestatic engine – malicious
CyrenW32/Trojan.XXFH-4100
AviraBDS/Gbot.eevy
FortinetRiskware/Sogou
Antiy-AVLTrojan/Win32.TSGeneric
Endgamemalicious (high confidence)
ZoneAlarmnot-a-virus:Downloader.Win32.Sogou.g
AhnLab-V3PUP/Win32.Downloader.R180775
AVwareTrojan.Win32.Generic!BT
VBA32Downloader.Sogou
ESET-NOD32a variant of Win32/Sogou.H potentially unwanted
YandexPUA.Downloader!
Ikarusnot-a-virus:Downloader.Sogou
AVGGeneric.537
PandaTrj/CI.A

How to remove Generic PUA DI (PUA)?

Generic PUA DI (PUA) removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment