Razy.151134 removal guide

The Razy.151134 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.151134 virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Razy.151134?


File Info:
name: 8C0BEDCD152F226DD266.mlw
path: /opt/CAPEv2/storage/binaries/fb01390b4b4280acb801d40d339f9d773d5d555e66ec00bae79a9a684d4ba234
crc32: FC709C6D
md5: 8c0bedcd152f226dd2661ab6897a3908
sha1: 8e3f9f79d7ee4b2cb82069e6205962ee51feb4ff
sha256: fb01390b4b4280acb801d40d339f9d773d5d555e66ec00bae79a9a684d4ba234
sha512: 25e4df7eeb003d68355b9261ac337f5a00c3f1e924feb3a725211b9e7dcce8b174cb6807abd7ed626dfc796bb81e1b145dac31578b6e86f888d10f02f2d705f9
ssdeep: 768:edGPMb8oA4LoYm5SfQBE3b/HFRIXG/cEF:7PR8osom3b/HFRIXucEF
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T152D2085767E89723EB3D2B7940621A054BF6CD254662FF2E3D8435E80CF770A4B81A87
sha3_384: 2b9e97ed18fe523a015c99636b283695e2ee9483dc46a09e9daa9211a3a6d947071f7ef96cee204a4e7d376d474097ce
ep_bytes: ff250020400000000000000000000000
timestamp: 2017-05-15 21:11:24

Version Info:
Translation: 0x0000 0x04b0
CompanyName: Microsoft
FileDescription: server
FileVersion: 1.0.0.0
InternalName: server.exe
LegalCopyright: Copyright © Microsoft 2017
OriginalFilename: server.exe
ProductName: server
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Razy.151134 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.151134
FireEye	Generic.mg.8c0bedcd152f226d
ALYac	Gen:Variant.Razy.151134
Malwarebytes	Backdoor.Bladabindi
Zillya	Dropper.Agent.Win32.443033
Sangfor	Trojan.MSIL.Agent.AKH
K7AntiVirus	Trojan ( 004971411 )
BitDefender	Gen:Variant.Razy.151134
K7GW	Trojan ( 004971411 )
Cybereason	malicious.d152f2
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.AKH
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Generic
Alibaba	Backdoor:MSIL/Generic.869d16b7
NANO-Antivirus	Trojan.Win32.Disfa.epwwrf
Rising	Trojan.Generic/MSIL@AI.98 (RDM.MSIL:k6Rpljf+ez19XOgygC2tbg)
Ad-Aware	Gen:Variant.Razy.151134
Sophos	Mal/Generic-S
Comodo	TrojWare.MSIL.Dynamer.AS@7ewb3t
DrWeb	Trojan.DownLoader23.23307
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis!Trojan
Emsisoft	Gen:Variant.Razy.151134 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Backdoor.MSIL.cych
Avira	HEUR/AGEN.1101191
MAX	malware (ai score=82)
Antiy-AVL	Trojan/Generic.ASMalwS.20BCEC6
Microsoft	Trojan:Win32/Dynamer!rfn
ZoneAlarm	HEUR:Backdoor.MSIL.Generic
GData	Gen:Variant.Razy.151134
Cynet	Malicious (score: 99)
McAfee	Artemis!8C0BEDCD152F
VBA32	TScope.Trojan.MSIL
Cylance	Unsafe
Panda	Trj/GdSda.A
Tencent	Msil.Backdoor.Generic.Eadn
Yandex	Trojan.Disfa!4pIWKhZA/wo
Ikarus	Trojan-Dropper
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Agent.CUA!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34182.bq0@aafpZDf
AVG	Win32:Malware-gen
Avast	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (W)
MaxSecure	Trojan.Malware.300983.susgen

How to remove Razy.151134?

Razy.151134 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X