Razy.722357 removal guide

The Razy.722357 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Razy.722357 virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process attempted to delay the analysis task.
Attempts to connect to a dead IP:Port (5 unique times)
Drops a binary and executes it
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Steals private information from local Internet browsers
Network activity contains more than one unique useragent.
Collects information about installed applications
Checks the CPU name from registry, possibly for anti-virtualization
Attempts to modify proxy settings
Attempts to access Bitcoin/ALTCoin wallets
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Collects information to fingerprint the system

Related domains:

telete.in

apps.identrust.com

mantis.ug

michaeldiamantis.ug

How to determine Razy.722357?


File Info:
crc32: 8989AE30
md5: 6ebc441b966301fb0df9e020409349b4
name: upload_file
sha1: 0e241c16dfc4b0e3b918c86a0ae39bdaff7fd81f
sha256: 286c2eb8755215619d8cb48cc884091251729d5925b74444fe3b62c2c1a5acb5
sha512: 9d498a7db1b3abfd4ea06ded88bc9cf245b7a6bd7dcbf97612a525350291f2c616381b54c055afb7bc3e15c3b6103fd49fdb18c69d6fd38fca018c5976728270
ssdeep: 12288:wwK5QVZaFrHcjwZ1vBQQn1b49bu17oKPXXLDrRFQSF8hKcCqtyEEzfsICoieW2:jodHFNlP17oSXX9ShKFqty/xPiev
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
Translation: 0x0407 0x04b0
ProductVersion: 4175.2546.7542
InternalName: 7879je4p9jfertafsreg
FileVersion: 4175.2546.7542
OriginalFilename: 7879je4p9jfertafsreg.exe
ProductName: Cretzgshtruieilkzrjktu

Razy.722357 also known as:

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Gen:Variant.Razy.722357
FireEye	Generic.mg.6ebc441b966301fb
CAT-QuickHeal	Trojan.IGENERIC
McAfee	RDN/Generic.dx
ALYac	Gen:Variant.Razy.722357
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 0056ba031 )
BitDefender	Gen:Variant.Razy.722357
K7GW	Trojan ( 0056ba031 )
CrowdStrike	win/malicious_confidence_80% (W)
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
GData	Gen:Variant.Razy.722357
Kaspersky	Trojan.Win32.Chapak.eshr
Alibaba	Trojan:Win32/Chapak.a2dd1695
NANO-Antivirus	Trojan.Win32.Chapak.hpjtgz
ViRobot	Trojan.Win32.S.Agent.823296.ER
AegisLab	Trojan.Win32.Chapak.4!c
Tencent	Win32.Trojan.Inject.Auto
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Razy.722357 (B)
F-Secure	Trojan.TR/AD.MoksSteal.ezxkp
DrWeb	Trojan.Siggen9.63849
TrendMicro	PUA.Win32.Caypnamer.USXVPGV20
Trapmine	suspicious.low.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.Win32.Krypt
Cyren	W32/Trojan.LLTA-1988
Jiangmin	Trojan.Generic.fugws
Webroot	W32.Malware.Gen
Avira	TR/AD.MoksSteal.ezxkp
MAX	malware (ai score=88)
Antiy-AVL	Trojan/Win32.Chapak
Arcabit	Trojan.Razy.DB05B5
ZoneAlarm	Trojan.Win32.Chapak.eshr
Microsoft	Trojan:Win32/CryptInject!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Malware/Win32.Generic.C4174321
VBA32	Trojan.Chapak
Ad-Aware	Gen:Variant.Razy.722357
Malwarebytes	Spyware.Oski
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/GenKryptik.EOVA
TrendMicro-HouseCall	PUA.Win32.Caypnamer.USXVPGV20
Rising	Trojan.Generic@ML.100 (RDML:qEcigo4jImTHzXT+xv/kpQ)
SentinelOne	DFI – Suspicious PE
eGambit	Unsafe.AI_Score_83%
Fortinet	W32/Injector.EMPE!tr
AVG	Win32:PWSX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.25b

How to remove Razy.722357?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.