Categories: Malware

PWS:Win32/Yunsip!pz removal guide

The PWS:Win32/Yunsip!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Yunsip!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine PWS:Win32/Yunsip!pz?


File Info:
name: 3F671ABD7C46023AEEB3.mlwpath: /opt/CAPEv2/storage/binaries/76b85aebba18e3c53375f270d0f1f6916de9ff8e4e44a812637db165b451da67crc32: F987786Cmd5: 3f671abd7c46023aeeb38f5cf0126f93sha1: b80b7d0b206427d40a5fb5178d06a00e88091a06sha256: 76b85aebba18e3c53375f270d0f1f6916de9ff8e4e44a812637db165b451da67sha512: 7bd216885dac23df352c2a5f621a9f2efa7428b01f3677176c12e10721e65eeb6bce48a71e7b122f8761b229901ab6f1fe8ca0e91487851eeb3a9138de8ad3c6ssdeep: 3072:cDJpt9sSR0HUHPwZWLnWUfEAzV2IJIwTBftpmc+z+f3Q0M:cDHtfRQUHPw0TMoV2nwTBlhm8Utype: PE32 executable (DLL) (GUI) Intel 80386, for MS Windowstlsh: T1DA0591026AD470AAF597053E0AA4B7B7FE6A6DB1BCD84A470207DECCD431D07B6D0E46sha3_384: bfbdb68474b1ac4468e64c52f98e5e152b8ee23a2d377bce77a7894d8c843165ed6f13003183db581677dc0634610169ep_bytes: 558bec538b5d08568b750c578b7d1085timestamp: 2011-06-09 14:27:31
Version Info:
CompanyName: Microsoft CorporationFileDescription: Uniscribe Unicode script processorFileVersion: 1.0420.2600.5512 (xpsp.080413-2105)InternalName: UniscribeLegalCopyright: © Microsoft Corporation. All rights reserved.OriginalFilename: UniscribeProductName: Microsoft(R) Uniscribe Unicode script processorProductVersion: 1.0420.2600.5512Translation: 0x0409 0x04b0

PWS:Win32/Yunsip!pz also known as:

Bkav	W32.AIDetectMalware
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.1084
FireEye	Generic.mg.3f671abd7c46023a
CAT-QuickHeal	Trojan.MauvaiseRI.S5242729
Skyhigh	BehavesLike.Win32.PWSYunsip.cz
McAfee	PWS-Yunsip.gen.a
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Doina.1084
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Trojan ( 005514aa1 )
BitDefender	Gen:Variant.Doina.1084
K7GW	Trojan ( 005514aa1 )
CrowdStrike	win/malicious_confidence_100% (D)
Baidu	Win32.Trojan-Spy.Agent.aa
VirIT	Trojan.Win32.Agent.ANTV
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Agent.NWL
APEX	Malicious
ClamAV	Win.Trojan.Agent-1366997
Kaspersky	HEUR:Backdoor.Win32.Generic
NANO-Antivirus	Trojan.Win32.Agent.rgzka
Sophos	ML/PE-A
F-Secure	Trojan.TR/PSW.Yunsip.axyza
DrWeb	Trojan.PWS.Spy.20716
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Doina.1084 (B)
SentinelOne	Static AI – Malicious PE
MAX	malware (ai score=86)
GData	Win32.Trojan-Stealer.Yunsip.B
Jiangmin	Backdoor.Generic.bhxd
Google	Detected
Avira	TR/PSW.Yunsip.axyza
Varist	W32/Redosdru.B.gen!Eldorado
Antiy-AVL	Trojan/Win32.Agent.uwue
Kingsoft	malware.kb.a.1000
Xcitium	TrojWare.Win32.TrojanSpy.Agent.ny@4pn6tf
Arcabit	Trojan.Doina.D43C
ZoneAlarm	HEUR:Backdoor.Win32.Generic
Microsoft	PWS:Win32/Yunsip!pz
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Infostealer.R758
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZedlaF.36802.Zy@@a08BqAbi
ALYac	Gen:Variant.Doina.1084
TACHYON	Worm/W32.Yunsip.Zen
DeepInstinct	MALICIOUS
VBA32	TScope.Malware-Cryptor.SB
Cylance	unsafe
Panda	Trj/Genetic.gen
Rising	Trojan.Usp10Hijack!1.998B (CLASSIC)
Yandex	Trojan.GenAsa!LogooVIKaNc
Ikarus	Trojan.Spy.Agent
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Agent.NYB!tr
AVG	Win32:Yunsip-A [Wrm]
Avast	Win32:Yunsip-A [Wrm]
alibabacloud	Trojan:Win/Zusy