Categories: PUA

OxyPumper (PUA) removal guide

The OxyPumper (PUA) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What OxyPumper (PUA) virus can do?

Behavioural detection: Executable code extraction – unpacking
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine OxyPumper (PUA)?


File Info:
name: 3B2BCD3918E5D2E4BB96.mlwpath: /opt/CAPEv2/storage/binaries/422e0703698f86d6ed8fc1c336a2cb1962579849655542a1538a62f8766705b9crc32: A92728B8md5: 3b2bcd3918e5d2e4bb964f2aa2478d6asha1: 2fb2b75394e81bca8415ac36f54811cf7474d968sha256: 422e0703698f86d6ed8fc1c336a2cb1962579849655542a1538a62f8766705b9sha512: fd57dabb0410d736586a31ad47edf65445dbb590e9fb8a9ae0162803a36260c749f509146e4029705bd68e10228e27e6528150157717cb0b5165c6b4f3fafed4ssdeep: 3072:2zsiYlsNrvk0MaLNLrDVbdj0SVJcJXQJGf8:Hers0HLNLrDVbt0wJktype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T120D318263655CB01C26E253AD9CF416803F9AEC33673CB287D8A739D55523E36D0A6CEsha3_384: 2754f437c5456476292257bfa2ae0d8f2f430b161de31adbefb6a46fb4e2c12fb3bd12be86def5d8ee695e858b966c60ep_bytes: ff250020400000000000000000000000timestamp: 2022-08-13 06:42:07
Version Info:
Translation: 0x0000 0x04b0FileDescription: Service for Internet InformationFileVersion: 7.0.6101.19012InternalName: inetinfo.exeLegalCopyright: Copyright© 2012-2017OriginalFilename: inetinfo.exeProductVersion: 7.0.6101.19012Assembly Version: 7.0.6101.19012

OxyPumper (PUA) also known as:

Bkav	W32.AIDetectNet.01
MicroWorld-eScan	Gen:Variant.Razy.975534
FireEye	Generic.mg.3b2bcd3918e5d2e4
ALYac	Gen:Variant.Razy.975534
Cylance	Unsafe
VIPRE	Gen:Variant.Razy.975534
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Adware ( 0057dd0b1 )
K7GW	Adware ( 0057dd0b1 )
Cybereason	malicious.918e5d
Cyren	W32/TaskLoader.B.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/Adware.OxyPumper.AK
APEX	Malicious
Kaspersky	HEUR:Trojan-Downloader.MSIL.TaskLoader.gen
BitDefender	Gen:Variant.Razy.975534
NANO-Antivirus	Trojan.Win32.TaskLoader.jrkica
Avast	Win32:AdwareX-gen [Adw]
Ad-Aware	Gen:Variant.Razy.975534
Emsisoft	Gen:Variant.Razy.975534 (B)
McAfee-GW-Edition	GenericRXHX-YF!3B2BCD3918E5
Trapmine	malicious.moderate.ml.score
Sophos	OxyPumper (PUA)
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Razy.975534
Google	Detected
Avira	HEUR/AGEN.1203189
Arcabit	Trojan.Razy.DEE2AE
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win.Generic.C5083737
Acronis	suspicious
McAfee	GenericRXHX-YF!3B2BCD3918E5
MAX	malware (ai score=84)
Malwarebytes	Adware.OxyPumper
Rising	Trojan.Generic/MSIL@AI.93 (RDM.MSIL:Ra0opXFDqYwTNd76xwe0vQ)
Ikarus	AdWare.MSIL.OxyPumper
MaxSecure	Trojan.Malware.300983.susgen
BitDefenderTheta	Gen:NN.ZemsilF.34592.iq0@aavNnUk
AVG	Win32:AdwareX-gen [Adw]