Trojan.Heur.bu0bsu6yu7db (B) removal instruction

The Trojan.Heur.bu0bsu6yu7db (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Heur.bu0bsu6yu7db (B) virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Creates RWX memory
Anomalous binary characteristics

How to determine Trojan.Heur.bu0bsu6yu7db (B)?


File Info:
crc32: 02EB2B88
md5: c59c8cc5c9c7da8d20d53a1c4a7161b9
name: C59C8CC5C9C7DA8D20D53A1C4A7161B9.mlw
sha1: 19f32411619c89c9ed9d120df46ae52008613b58
sha256: 5cdc5c5ac9c8dab85aa6c1fc0c085fd12aa542b9cf21dd30060982e9b0c7b597
sha512: 90f57eb316ef87d3b88aacc72d81575393b1e03dc3093a8d6a653ffd4e4d6a390ddb4da905cb6eef14d0614da2797f98463fce83cae6387d36d3c56b7f1e8876
ssdeep: 12288:YgBFNnXgEEAwSfxL/2Dc3jDLLmt0LDQewsAjRd:7ZQEZaewsAj
type: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation.  All rights reserved.
InternalName: AddInProcess.exe
FileVersion: 3.5.21022.8 built by: RTM
CompanyName: Microsoft Corporation
PrivateBuild: DDBLD634
Comments: Flavor=Retail
ProductName: Microsoftxae .NET Framework
ProductVersion: 3.5.21022.8
FileDescription: AddInProcess.exe
OriginalFilename: AddInProcess.exe
Translation: 0x0409 0x04b0

Trojan.Heur.bu0bsu6yu7db (B) also known as:

K7AntiVirus	Riskware ( 0040eff71 )
DrWeb	Win32.HLLW.Autoruner.547
Cynet	Malicious (score: 100)
ALYac	Gen:Trojan.Heur.bu0bsu6yu7db
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
Alibaba	Worm:Win32/Ransomware.c7c60842
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.5c9c7d
Cyren	W32/Patched.FC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:VB-FBX
ClamAV	Win.Ransomware.WannaCry-9856297-0
BitDefender	Gen:Trojan.Heur.bu0bsu6yu7db
MicroWorld-eScan	Gen:Trojan.Heur.bu0bsu6yu7db
Sophos	ML/PE-A
BitDefenderTheta	AI:Packer.DFF53E5D1C
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Fujacks.jh
FireEye	Generic.mg.c59c8cc5c9c7da8d
Emsisoft	Gen:Trojan.Heur.bu0bsu6yu7db (B)
SentinelOne	Static AI – Malicious PE
Microsoft	Trojan:Win32/Tiggre!rfn
AegisLab	Trojan.Win32.Autorun.4!c
GData	Gen:Trojan.Heur.bu0bsu6yu7db
McAfee	RDN/Autorun.worm.gen
MAX	malware (ai score=89)
VBA32	Worm.AutoRun
Malwarebytes	Generic.Trojan.Malicious.DDS
Ikarus	Trojan.Msil
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	MSIL/Agent.FF47!tr
AVG	Win32:VB-FBX
Paloalto	generic.ml
Qihoo-360	Win32/Worm.AutoRun.HgIASWcA

How to remove Trojan.Heur.bu0bsu6yu7db (B)?

Trojan.Heur.bu0bsu6yu7db (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X