About “Razy.666611” infection

The Razy.666611 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.666611 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Presents an Authenticode digital signature
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial binary language: Russian
• Unconventionial language used in binary resources: Russian
• Authenticode signature is invalid
• CAPE detected the embedded win api malware family
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Razy.666611?

File Info:
name: CE448E4C1B1983C2A83C.mlw
path: /opt/CAPEv2/storage/binaries/afe544a705742835ef05226a5e9e0cda3f5d49450523b30a2cb3f0122109a5c3
crc32: 9D1DD5B9
md5: ce448e4c1b1983c2a83cb80b7cc88860
sha1: 38404708d0daf7df4f852cdd5c5e029806339356
sha256: afe544a705742835ef05226a5e9e0cda3f5d49450523b30a2cb3f0122109a5c3
sha512: 69667cf639ce7cdfed4f431898aed26b163f8e1f4101fe71f0411baeabdf5960e96d9c8b64ef177d261dfa281aae1f792ae246ac034183891d46f2535e541cb3
ssdeep: 12288:12juWBn9am2KmFL1ydntMYGShnVI3jy1m1S:1Uu29aq98asjyd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B1A4E02A773DF41CE1CDA2BD4966C8B5C7167C28361C00879227B62B763BDF166643E8
sha3_384: 6949f4b2c6413db4cffc625c334b7a3f7651fbc1c358d1c62243b082b89475a865b06811d30c5fcea227d966539efdae
ep_bytes: 558bec51c745fc58180000c745fc5818
timestamp: 2012-12-21 23:39:33

Version Info:
CompanyName: Корпорация Майкрософт
FileDescription: Звукозапись
FileVersion: 5.1.2600.5512 (xpsp.080413-0845)
InternalName: soundrec.exe
LegalCopyright: © Корпорация Майкрософт. Все права защищены.
OriginalFilename: sndrec32.exe
ProductName: Операционная система Microsoft® Windows®
ProductVersion: 5.1.2600.5512
Translation: 0x0419 0x04b0

Razy.666611 also known as:

How to remove Razy.666611?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.