How to remove “Lazy.211948”?

The Lazy.211948 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Lazy.211948 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• CAPE detected the Cerber malware family
• Attempts to access Bitcoin/ALTCoin wallets
• Collects information to fingerprint the system
• Uses suspicious command line tools or Windows utilities

How to determine Lazy.211948?

File Info:
name: A77DBCACED1A433F684E.mlw
path: /opt/CAPEv2/storage/binaries/44cced878c6555c3b52aae3aa7009d1acfbd29366f93b66990669e73d27544f5
crc32: 26A7BA53
md5: a77dbcaced1a433f684ec97d6afade32
sha1: 0a03db7e1491673792a4e0b3f6a1c1109ee58b87
sha256: 44cced878c6555c3b52aae3aa7009d1acfbd29366f93b66990669e73d27544f5
sha512: 7eef0f21603b333c1ae6bbb6a818560120671d1c0a1f990b28e0ce8c87cb32d34a5a51ce176fac0eea2e2bed94ab8d56c6d457095839741215e40fcb68384ed2
ssdeep: 6144:ZdyqcoXKbVY3nmgbrSJQgkiGXmN8TQptqKQG:moXWVlgbrkurS0oss
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FA645BF573EF63FEDDFD42F0F40924278218F54CE8EACA86579009AE2966393C521642
sha3_384: 933eb769d9fb74cf8a3c10492bb80aaaf067ba8c0c2b11ca5fca53fb91bfe2028974567431d37ae2d07c47d1277d8478
ep_bytes: 558bec83ec18578b45f88b4df8d3e889
timestamp: 2017-03-06 12:48:03

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Word Converter
FileVersion: 12.0.6500.5000
InternalName: WordConv
LegalCopyright: © 2006 Microsoft Corporation.  All rights reserved.
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFilename: WordConv.exe
ProductName: 2007 Microsoft Office system
ProductVersion: 12.0.6500.5000
Translation: 0x0409 0x04e4

Lazy.211948 also known as:

How to remove Lazy.211948?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.