How to remove “Razy.88936”?

The Razy.88936 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Razy.88936 virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Razy.88936?


File Info:
name: 74B09B902662290BFC08.mlw
path: /opt/CAPEv2/storage/binaries/559dc7e5bb62e05a5df3aa6fb7d4a45a46e80dbac3f601879c99a670d4cbcbd0
crc32: 365E66B0
md5: 74b09b902662290bfc08ad35c3ed518a
sha1: c01f487b92c4eac493b7584bc4571226cdcc83d3
sha256: 559dc7e5bb62e05a5df3aa6fb7d4a45a46e80dbac3f601879c99a670d4cbcbd0
sha512: f764a5a9b611c4bc2acf14a5a68e97165f7695ecd2cdc8ecdebea3ac832495298bbeb2eb8abab6e82cc819482386e53337a1a143b38dfaae464547e578575e0a
ssdeep: 1536:3QabuxgLbJnbQvVPsoYmnHFGSilKBZdDf7yQih6t0V+7PHtCoQTZ9mN0LYAN5XWH:39bqgpbkPBfGQfY4PcTlWjBSzc2FEQo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T185348D43E3D8F472E73A08B01A466D660DEABD30E954853BFAC80E5E72B0DD5A43535B
sha3_384: 965d22e94c97e1bb0215ab15b543c7a582088750e3fd8db9f874e6d11c951d164d26317d25987f3f954aad3608e9c874
ep_bytes: 68846b4000e8f0ffffff000000000000
timestamp: 2002-12-17 23:43:05

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Digitope
FileDescription: FontPak
LegalCopyright: Copyright © 2001-2002 by Eric J. LeVin II & Daniel J. LeVin. All Rights Reserved.
LegalTrademarks: Digitope™, FontZip™, InstantInstall™ and FontPak™ are trademarks of Eric J. LeVin II. All Rights Reserved.
ProductName: Digitope FontZip
FileVersion: 3.05.0002
ProductVersion: 3.05.0002
InternalName: fontface
OriginalFilename: fontface.exe

Razy.88936 also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Razy.88936
FireEye	Generic.mg.74b09b902662290b
CAT-QuickHeal	Worm.PalevoVMF.S2281207
McAfee	Artemis!74B09B902662
Zillya	Trojan.Injector.Win32.280064
K7AntiVirus	Trojan ( 0055e3991 )
BitDefender	Gen:Variant.Razy.88936
K7GW	Trojan ( 0055e3991 )
Cybereason	malicious.026622
Symantec	ML.Attribute.HighConfidence
NANO-Antivirus	Trojan.Win32.Palevo.ebbisv
Ad-Aware	Gen:Variant.Razy.88936
Sophos	Mal/Generic-R + Troj/Palevo-CX
McAfee-GW-Edition	BehavesLike.Win32.Generic.dm
SentinelOne	Static AI – Malicious PE
Emsisoft	Gen:Variant.Razy.88936 (B)
APEX	Malicious
Jiangmin	Worm.Palevo.i
Avira	WORM/Palevo.mwtlc
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
SUPERAntiSpyware	Worm.Palevo/Variant
GData	Gen:Variant.Razy.88936
Cynet	Malicious (score: 100)
VBA32	Worm.Palevo
ALYac	Gen:Variant.Razy.88936
MAX	malware (ai score=85)
Malwarebytes	Worm.Palevo
Yandex	Trojan.GenAsa!YuXofyTEjWU
Ikarus	P2P-Worm.Win32.Palevo
Fortinet	W32/PossibleThreat
AVG	Win32:WrongInf-E [Susp]
Avast	Win32:WrongInf-E [Susp]
CrowdStrike	win/malicious_confidence_80% (W)

How to remove Razy.88936?

Razy.88936 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X