Should I remove “Razy.859339”?

The Razy.859339 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.859339 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Presents an Authenticode digital signature
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Razy.859339?


File Info:
name: E3B4E3BBBA2944949300.mlw
path: /opt/CAPEv2/storage/binaries/1af460cfea13f579f1aabeb1777133826e555f08db34f3e1b6c8f265c56227ab
crc32: DF6068BF
md5: e3b4e3bbba29449493008601307045e3
sha1: 48055afc10c6cebcb23aece75f119f1a92d26db3
sha256: 1af460cfea13f579f1aabeb1777133826e555f08db34f3e1b6c8f265c56227ab
sha512: 0e41887e15a7def4417ac368b9aa4c43ef6d4f8221d59cd4e42c42a565971d88ebe5e68ed6bc0063bf0874261fcf9e44420887a1d3fae60db5a570d0d4f4ddff
ssdeep: 49152:UkwkgTEvP52/IabjKoh9WsAlYvoGxUSJpX:FJlcIabjKoh9WsAsRX
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11B855C0173945D61E06A51BB68E69717EAB17C900B2187C7B354BB2D9F33AE06FB3312
sha3_384: 21fbe46cc2c8aa5d0c81c0322f2378c8120151d12afd90bdd647f2edcf8a2a8fac82686608acaf27c6919b41c33103e4
ep_bytes: e8d9030000e937fdffff68bd79400064
timestamp: 2013-11-21 16:55:51

Version Info:
CompanyName: Adobe Systems Incorporated
FileDescription: Adobe Acrobat Update Service
FileVersion: 1.701.3.3014
InternalName: armsvc.exe
LegalCopyright: Copyright © 2013 Adobe Systems Incorporated.  All rights reserved.
OriginalFilename: armsvc.exe
ProductName: Adobe Acrobat Update Service
ProductVersion: 1.701.3.3014
Translation: 0x0409 0x04b0

Razy.859339 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.38130303
FireEye	Gen:Variant.Razy.859339
ALYac	Gen:Variant.Razy.859339
Malwarebytes	Malware.AI.3696146603
BitDefenderTheta	AI:Packer.BD0AD5381E
Cyren	W32/Agent.DOH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Worm.Vindor-9886047-0
BitDefender	Gen:Variant.Razy.859339
Avast	Win32:VB-FBX
Emsisoft	Gen:Variant.Razy.859339 (B)
DrWeb	Win32.HLLW.Autoruner.547
TrendMicro	WORM_AUTORUN.BGA
McAfee-GW-Edition	BehavesLike.Win32.Dropper.th
Sophos	ML/PE-A + W32/FakeFire-H
Ikarus	Trojan.Dropper
GData	Gen:Variant.Razy.859339
Jiangmin	Trojan.Generic.gzwbl
MaxSecure	Trojan.Malware.121218.susgen
Avira	HEUR/AGEN.1143052
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Generic.ASBOL.C67A
Arcabit	Trojan.Razy.DD1CCB
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!E3B4E3BBBA29
VBA32	Worm.AutoRun
TrendMicro-HouseCall	WORM_AUTORUN.BGA
Rising	Worm.VB!1.DA41 (CLASSIC)
Yandex	Trojan.GenAsa!g8z8LT30jj4
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.B033!tr
AVG	Win32:VB-FBX

How to remove Razy.859339?

Razy.859339 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X