PWS:Win32/Yunsip.A removal

The PWS:Win32/Yunsip.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PWS:Win32/Yunsip.A virus can do?

Creates RWX memory
Network activity detected but not expressed in API logs

How to determine PWS:Win32/Yunsip.A?


File Info:
crc32: DD0E0DDC
md5: 6baa02ace14e508b7df181df3043e8cf
name: 6BAA02ACE14E508B7DF181DF3043E8CF.mlw
sha1: 7eb0937bac85f15ab270379fa7c1b5a0dbf2a5fc
sha256: 5295bcbbb3f9953e42ce7fba08b95f0c99defda0a17737aca80acac05df76d34
sha512: d25fb43923d420b9f68147612b3d77192921e2671f68b6a7bee78f4200766eb32b171915762035b7b94b078e93163c64dde8cc72d2ea06ac907d06c1b087acfc
ssdeep: 3072:j9eIuMO5gi/10UtBDnX2iY5e9RXwTBftrm2YedGf3QKZDn:j9bG5N/eoXnY5enwTBlrIckP9
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Uniscribe
FileVersion: 1.0420.2600.5512 (xpsp.080413-2105)
CompanyName: Microsoft Corporation
ProductName: Microsoft(R) Uniscribe Unicode script processor
ProductVersion: 1.0420.2600.5512
FileDescription: Uniscribe Unicode script processor
OriginalFilename: Uniscribe
Translation: 0x0409 0x04b0

PWS:Win32/Yunsip.A also known as:

Bkav	W32.AIDetectVM.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.319665
FireEye	Generic.mg.6baa02ace14e508b
CAT-QuickHeal	TrojanPWS.Yunsip.A5
ALYac	Gen:Variant.Zusy.319665
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (D)
K7GW	Trojan ( 00060f0b1 )
K7AntiVirus	Trojan ( 00060f0b1 )
Baidu	Win32.Trojan-Spy.Agent.aa
Cyren	W32/Redosdru.B.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	HEUR:Backdoor.Win32.Generic
BitDefender	Gen:Variant.Zusy.319665
ViRobot	Trojan.Win32.Agent.131072.BJ
Tencent	Trojan.Win32.FakeMS.tpd
Ad-Aware	Gen:Variant.Zusy.319665
Sophos	Mal/YunSip-A
F-Secure	Trojan.TR/PSW.Yunsip.axyza
Invincea	ML/PE-A + Mal/YunSip-A
McAfee-GW-Edition	BehavesLike.Win32.PWSYunsip.gz
Emsisoft	Gen:Variant.Zusy.319665 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor.Generic.bhxd
Avira	TR/PSW.Yunsip.axyza
Microsoft	PWS:Win32/Yunsip.A
Arcabit	Trojan.Zusy.D4E0B1
ZoneAlarm	HEUR:Backdoor.Win32.Generic
GData	Win32.Trojan-Stealer.Yunsip.A
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Infostealer.R758
Acronis	suspicious
McAfee	PWS-Yunsip.gen.a
MAX	malware (ai score=89)
VBA32	TScope.Malware-Cryptor.SB
Malwarebytes	Spyware.PasswordStealer
Panda	Generic Suspicious
ESET-NOD32	a variant of Win32/Agent.NWL
TrendMicro-HouseCall	WORM_YUNSIP.SMR
Rising	Trojan.Hijcusp!1.998B (CLASSIC)
Yandex	Trojan.GenAsa!LogooVIKaNc
Ikarus	Backdoor.Win32.Inject
Fortinet	W32/Agent.NYB!tr
BitDefenderTheta	Gen:NN.ZedlaF.34634.Au@@a05rPXji
AVG	Win32:Yunsip-A [Wrm]
Qihoo-360	Trojan.Win32.FakeUsp.E

How to remove PWS:Win32/Yunsip.A?

PWS:Win32/Yunsip.A removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X