Categories: PUA

About “PUA:Win32/Youxun” infection

The PUA:Win32/Youxun is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What PUA:Win32/Youxun virus can do?

  • Presents an Authenticode digital signature
  • Unconventionial binary language: Chinese (Simplified)
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Network activity detected but not expressed in API logs
  • Anomalous binary characteristics

How to determine PUA:Win32/Youxun?


File Info:

crc32: E104ACF3md5: f063a1e88c8cee2633bd2a0610792a06name: ______orc__________________v8.1______________________205243882.exesha1: 1e2e119a5c0ad5d625fb29b21e578e915f34e596sha256: 23dd15e8b6caae4d9849b62ed7755a7eff4c92e196f1d7d04352c360b4a3c1f3sha512: b7199e95aa9b0f47bae4c09386f264bdf071d0f5a388e082f01b2ab51bc5d5e1fdfc8d4e6fcde3a1fc812e8c8f9a7b208aeb399ec347cd6727fb9279c35c5674ssdeep: 196608:3VOjuLuNfsj89Z4w66PV9fd6Hoj+5FT4zqyRrS:PuNfsCP/8HW+oWiStype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

LegalCopyright: Copyright (C) 2019 Shanghai Youwo Information Technology Co., Ltd.InternalName: SetupFileVersion: 1, 2, 3, 7Comments: x5b89x88c5x5411x5bfcProductName: x5b89x88c5x5411x5bfcProductVersion: 1, 2, 3, 7FileDescription: x5b89x88c5x5411x5bfcOriginalFilename: Setup.exeTranslation: 0x0804 0x04b0

PUA:Win32/Youxun also known as:

MicroWorld-eScan Trojan.GenericKD.32772148
FireEye Generic.mg.f063a1e88c8cee26
CAT-QuickHeal Trojan.Youxun
McAfee Artemis!F063A1E88C8C
Cylance Unsafe
VIPRE Trojan.Win32.Generic!BT
Sangfor Malware
K7AntiVirus Riskware ( 0054b91b1 )
BitDefender Trojan.GenericKD.32772148
K7GW Riskware ( 0054b91b1 )
Invincea heuristic
APEX Malicious
Avast Win32:Malware-gen
GData Trojan.GenericKD.32772148
Kaspersky not-a-virus:Downloader.Win32.YXdown.adk
Alibaba Downloader:Win32/YXdown.b8dbe399
Paloalto generic.ml
AegisLab Riskware.Win32.YXdown.1!c
Ad-Aware Trojan.GenericKD.32772148
Emsisoft Trojan.GenericKD.32772148 (B)
Comodo Malware@#xouud706p4q9
Zillya Tool.YouXun.Win32.770
McAfee-GW-Edition Artemis!Trojan
Sophos Mal/Generic-S
SentinelOne DFI – Suspicious PE
Cyren W32/Trojan.ZHMA-8755
Jiangmin Downloader.YXdown.aq
Webroot W32.Malware.Gen
Endgame malicious (high confidence)
Arcabit Trojan.Generic.D1F41034
ZoneAlarm not-a-virus:Downloader.Win32.YXdown.adk
Microsoft PUA:Win32/Youxun
AhnLab-V3 PUP/Win32.Agent.R307138
ALYac Trojan.GenericKD.32772148
MAX malware (ai score=100)
VBA32 BScope.Trojan.FakeAlert
Malwarebytes RiskWare.YouXun
ESET-NOD32 a variant of Win32/RiskWare.YouXun.L
TrendMicro-HouseCall TROJ_GEN.R004H0CL219
Rising PUA.Youxun!8.F60F (CLOUD)
Yandex RiskWare.YouXun!
eGambit Unsafe.AI_Score_66%
Fortinet W32/Eldorado.5AE8!tr
MaxSecure Trojan.Malware.74719855.susgen
AVG Win32:Malware-gen
Panda Trj/CI.A

How to remove PUA:Win32/Youxun?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Share
Published by
Paul Valéry

Recent Posts

Trojan:Win32/Strab.GPG!MTB removal guide

The Trojan:Win32/Strab.GPG!MTB is considered dangerous by lots of security experts. When this infection is active,…

15 mins ago

Trojan.Win32.Agent.xbocpf removal

The Trojan.Win32.Agent.xbocpf is considered dangerous by lots of security experts. When this infection is active,…

54 mins ago

What is “Malware.AI.4092848701”?

The Malware.AI.4092848701 is considered dangerous by lots of security experts. When this infection is active,…

55 mins ago

About “Trojan.Generic.35764356” infection

The Trojan.Generic.35764356 is considered dangerous by lots of security experts. When this infection is active,…

60 mins ago

What is “Generic.Dacic.94CCEEA9.A.D4FB9FDA”?

The Generic.Dacic.94CCEEA9.A.D4FB9FDA is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

What is “MSILHeracles.58916”?

The MSILHeracles.58916 is considered dangerous by lots of security experts. When this infection is active,…

2 hours ago