Razy.818633 removal

The Razy.818633 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.818633 virus can do?

CAPE extracted potentially suspicious content
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Razy.818633?


File Info:
name: DDB85895989655B59B25.mlw
path: /opt/CAPEv2/storage/binaries/78b7a64688a12584b82efd7692f31e16212bac7cf89254648c731a6b7b2c6854
crc32: 874C0DF3
md5: ddb85895989655b59b25f998895049f9
sha1: 0a07705db17b437a8764eebf5b6c2262ecf977df
sha256: 78b7a64688a12584b82efd7692f31e16212bac7cf89254648c731a6b7b2c6854
sha512: 05dd8c3442751f96aeb8da2b8fbdbb2b799a1dfa2df3ed20584bbbab48df2228831170c0694039a0d979a82a73cdb5587d97ced54e8a7f41c2291812dbd42129
ssdeep: 1536:nopHgRYRgEIpHD5DUL2C5ZwHq6JPSqpCDig51AGJ5mBR6T:o11+RHD5Db2Uq6xSqgig51AG6nC
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14693720331CC6BA9C43426B0A2FB56A047E1EFD61532DB58EEC972C95C353937E52B89
sha3_384: ca0f310fb6f566e204e9d2d6e559a0292d7d8c733111f8a43bb3da55554dae2998e155b378ac7fd019396929fd3f18e5
ep_bytes: ff250020400000000000000000000000
timestamp: 2017-10-24 14:28:07

Version Info:
Translation: 0x0000 0x04b0
FileDescription: Microsoft Occle
FileVersion: 1.0.0.0
InternalName: Microsoft Occle.exe
LegalCopyright: Copyright ©  2017
OriginalFilename: Microsoft Occle.exe
ProductName: Microsoft Occle
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Razy.818633 also known as:

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.818633
FireEye	Generic.mg.ddb85895989655b5
McAfee	GenericRXAA-FA!DDB858959896
Cylance	Unsafe
Zillya	Dropper.Agent.Win32.279599
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 0049b0ec1 )
Alibaba	Trojan:MSIL/Generic.4ab29b19
K7GW	Trojan ( 0049b0ec1 )
Cybereason	malicious.598965
BitDefenderTheta	Gen:NN.ZemsilF.34592.fq0@aKG54Hl
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/TrojanDropper.Agent.AQJ
Paloalto	generic.ml
ClamAV	Win.Malware.Unsafe-6997914-0
Kaspersky	HEUR:Trojan.MSIL.Generic
BitDefender	Gen:Variant.Razy.818633
NANO-Antivirus	Trojan.Win32.Bladabindi.euqqhe
Cynet	Malicious (score: 100)
Avast	Win32:Malware-gen
Tencent	Malware.Win32.Gencirc.11495f20
Ad-Aware	Gen:Variant.Razy.818633
Emsisoft	Gen:Variant.Razy.818633 (B)
Comodo	Malware@#l7ty8moj7gm3
DrWeb	Trojan.DownLoader25.49138
VIPRE	Gen:Variant.Razy.818633
McAfee-GW-Edition	BehavesLike.Win32.Trojan.nm
SentinelOne	Static AI – Malicious PE
Trapmine	malicious.moderate.ml.score
Sophos	Mal/Generic-S
APEX	Malicious
GData	Gen:Variant.Razy.818633
Avira	HEUR/AGEN.1227673
Antiy-AVL	Trojan/Win32.AGeneric
ZoneAlarm	HEUR:Trojan.MSIL.Generic
Microsoft	Backdoor:Win32/Skeeyah.A!rfn
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5215467
Acronis	suspicious
ALYac	Gen:Variant.Razy.818633
MAX	malware (ai score=100)
Rising	Trojan.Generic/MSIL@AI.98 (RDM.MSIL:F6v8bHkWai14zXfFm6neWQ)
Yandex	Trojan.Agent!q+f7+OhyXhI
Ikarus	Trojan-Dropper.MSIL.Agent
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/Kryptik.GVM!tr
AVG	Win32:Malware-gen
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_60% (W)

How to remove Razy.818633?

Razy.818633 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X