How to remove “Razy.503476”?

The Razy.503476 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.503476 virus can do?

CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Razy.503476?


File Info:
name: B459DA915BEEED9BCC12.mlw
path: /opt/CAPEv2/storage/binaries/7ce230a7de9e9b616579cf5b730fc8d9d9814fab74817d8be224535e7d7bd1cb
crc32: CF86DA98
md5: b459da915beeed9bcc1289327df589b7
sha1: 0ab3d94807c2faa0fc6e167ac41f8bb68d803706
sha256: 7ce230a7de9e9b616579cf5b730fc8d9d9814fab74817d8be224535e7d7bd1cb
sha512: fd53eeca02013cba061dd71ca87b49581c8bcaba038c661416fa2459ab61372d5e602f68a58e119294c5be46ffa3e30e748351609a58652d311d2805df9f9235
ssdeep: 768:Bc6daF5QhycLHiBgOaeY5FCC0CnbO0vvS3rYHIxFQaNudKdxrbqBylmMRINlvdVA:B3LiaOaeY5O9oZ2FQdKziB0mCAW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E7B3F5172354CF56C53946B029134FDC0A23BF417A91FDAB28C0668F7DB92C68A9B25F
sha3_384: a34c2717dc491f067a0981a6b0e4c4ae4dc6a81940d5c2c6b1d24f22ef14c8384ce59035cd8d52817f56c604e6c4d0f5
ep_bytes: ff250020400000000000000000000000
timestamp: 2015-12-19 11:12:07

Version Info:
Translation: 0x0000 0x04b0
FileDescription: WindowsApplication1
FileVersion: 1.0.0.0
InternalName: WindowsApplication1.exe
LegalCopyright: Copyright ©  2015
OriginalFilename: WindowsApplication1.exe
ProductName: WindowsApplication1
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Razy.503476 also known as:

Bkav	W32.AIDetectNet.01
MicroWorld-eScan	Gen:Variant.Razy.503476
FireEye	Generic.mg.b459da915beeed9b
ALYac	Gen:Variant.Razy.503476
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Password-Stealer ( 0055e3ee1 )
K7GW	Password-Stealer ( 0055e3ee1 )
Cybereason	malicious.15beee
Cyren	W32/S-01aa79d5!Eldorado
Symantec	Trojan.Gen.2
Elastic	malicious (moderate confidence)
ESET-NOD32	a variant of MSIL/PSW.OnLineGames.ZH
APEX	Malicious
Cynet	Malicious (score: 99)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Razy.503476
Avast	Win32:Malware-gen
Rising	Trojan.Generic/MSIL@AI.96 (RDM.MSIL:2qf131rn40sqTwYc1cDNJA)
Ad-Aware	Gen:Variant.Razy.503476
Emsisoft	Gen:Variant.Razy.503476 (B)
Comodo	Malware@#1padnfwng3t10
VIPRE	Gen:Variant.Razy.503476
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
Ikarus	Trojan.MSIL.PSW
GData	Gen:Variant.Razy.503476
Avira	TR/Spy.OnlGame.114176
Arcabit	Trojan.Razy.D7AEB4
Microsoft	Trojan:Win32/Skeeyah.A!rfn
Google	Detected
McAfee	Artemis!B459DA915BEE
MAX	malware (ai score=86)
Malwarebytes	PUP.Optional.Amonetize
Yandex	Trojan.PWS.OnLineGames!/8qFlpdcBuA
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Razy.503476?

Razy.503476 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X