Razy.549169 removal tips

The Razy.549169 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.549169 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Razy.549169?

File Info:
name: 8140BAC2A2F1952BF193.mlw
path: /opt/CAPEv2/storage/binaries/d52e0ce15f5144a03d3beb68de48157bf443e129a7039021adf1d060a440b1e3
crc32: 5E79F4D1
md5: 8140bac2a2f1952bf193d4180bc866ec
sha1: 5f2021edcd1000139d0d22be77d5f563a69ccc6a
sha256: d52e0ce15f5144a03d3beb68de48157bf443e129a7039021adf1d060a440b1e3
sha512: a5876b38f0a8632a332812136a99376c481d5b8cc37857fa987aa96e242704d041863512e1d2cc5bf3457f6343e4b3b991c3edd131dd1fd82532bfa7f9a174a2
ssdeep: 6144:Ewg8Ge2dxOqSeknVwo8piwczDZEhgLasNyvQQSY9x+SzyibP3bw8g:LCzOBeOIilBvMYQSozyatg
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T111A4DF4E76FCF580CBCE5C3215A287B11B253E107B4DBA87656FAF1A66380A01F137A4
sha3_384: 03fbbe181eab8c2f749ca263225a3a3bd0c1b278ad12f41919f60cc019a413df506766104be17e75230d5e7a590f24b8
ep_bytes: 558bec51c745fc58180000c745fc5818
timestamp: 2012-12-23 00:13:01

Version Info:
CompanyName: Корпорация Майкрософт
FileDescription: Звукозапись
FileVersion: 5.1.2600.5512 (xpsp.080413-0845)
InternalName: soundrec.exe
LegalCopyright: © Корпорация Майкрософт. Все права защищены.
OriginalFilename: sndrec32.exe
ProductName: Операционная система Microsoft® Windows®
ProductVersion: 5.1.2600.5512
Translation: 0x0419 0x04b0

Razy.549169 also known as:

How to remove Razy.549169?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.