How to remove “Razy.649271”?

The Razy.649271 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.649271 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates the modules from a process (may be used to locate base addresses in process injection)
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Created a process from a suspicious location

How to determine Razy.649271?

File Info:
name: 11576A80CD7C87A79F37.mlw
path: /opt/CAPEv2/storage/binaries/db9a96a73788abadee06ac6255ea92097ba607fccaea64e6e03566e986f00adb
crc32: 2930CA8C
md5: 11576a80cd7c87a79f37cc53904ef916
sha1: 016bafb033a9a98616189231922e8b8687a2608a
sha256: db9a96a73788abadee06ac6255ea92097ba607fccaea64e6e03566e986f00adb
sha512: 57def1ee768888afa6758f96bede11bd8610431101c4bf764b7f92daf5946a5d8d5bc79797d13645c70d1768d92c65118b04bb29d330980b9e29b8c4f65c44e5
ssdeep: 12288:65aiViPI9OFzdrx7+py1Wc1DLyO/1PcEU3NU4VLxxy0LsWVnSi:L2iyOFzdxZn/RcEU3NBHQi
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T178B422151395D8ABCA3A07F2C407AB729C68BF0A141BC90353F93D6A54BFDBB5C0619B
sha3_384: b743f1c8ab6d4e681cfe7e1121e298e2298f24db16b78de34761a1377f5af63ff73a5c45e93f797ec39c61e2edb93fa4
ep_bytes: 558bec81ec80010000535633db57895d
timestamp: 2007-03-31 15:09:46

Version Info:
0: [No Data]

Razy.649271 also known as:

How to remove Razy.649271?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.