Win32/Filecoder.NZY removal guide

Malware Removal

The Win32/Filecoder.NZY is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

ribbon

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
THANK YOU!
DOWNLOAD NOW
On Going Offer

What Win32/Filecoder.NZY virus can do?

  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • HTTP traffic contains suspicious features which may be indicative of malware related traffic
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Chinese (Simplified)
  • The binary likely contains encrypted or compressed data.
  • Attempts to stop active services
  • Steals private information from local Internet browsers
  • Installs itself for autorun at Windows startup
  • Exhibits possible ransomware file modification behavior

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Win32/Filecoder.NZY?


File Info:

crc32: 3CA12B95
md5: 853358339279b590fb1c40c3dc0cdb72
name: cpt.dat
sha1: 84825801eac21a8d6eb060ddd8a0cd902dcead25
sha256: ca154fa6ff0d1ebc786b4ea89cefae022e05497d095c2391331f24113aa31e3c
sha512: 8c84d526d35e9e74848eb062a9332f7eadb4566fb5bdea05a87120a48b9fc38caa6883e16aec7ff0c3c4237930a4e2d2657164f663294097a0e2b698e2d7c46d
ssdeep: 24576:iX2a9xmONW3KfIJxp7tgrdSh6AuMAG9y0wc0txzcvmgbC4z+4:im4xxDfIjp7+Rs6AuFG9ypxAmH
type: MS-DOS executable, MZ for MS-DOS

Version Info:

LegalCopyright: Copyright (C) 2019
InternalName: cpt.exe
FileVersion: 1.0.0.1
CompanyName: TODO: 5SS5C
ProductName: TODO: 5SS5C Encoder
ProductVersion: 1.0.0.1
FileDescription: TODO: 5SS5C Encoder
OriginalFilename: cpt.exe
Translation: 0x0409 0x04b0

Win32/Filecoder.NZY also known as:

MicroWorld-eScanGen:Variant.Ulise.85367
CMCVirus.Win32.Sality!O
McAfeeArtemis!853358339279
CylanceUnsafe
SangforMalware
K7AntiVirusTrojan ( 0055eadc1 )
BitDefenderGen:Variant.Ulise.85367
K7GWTrojan ( 0055eadc1 )
CrowdStrikewin/malicious_confidence_90% (W)
Invinceaheuristic
ESET-NOD32Win32/Filecoder.NZY
APEXMalicious
Paloaltogeneric.ml
TencentWin32.Trojan.Agent.Auto
Endgamemalicious (high confidence)
EmsisoftGen:Variant.Ulise.85367 (B)
F-SecureTrojan.TR/FileCoder.jplej
DrWebTrojan.DownLoader32.46808
McAfee-GW-EditionBehavesLike.Win32.ZeroAccess.tc
FortinetW32/Filecoder.NZY!tr
Trapminemalicious.high.ml.score
FireEyeGeneric.mg.853358339279b590
SophosMal/Generic-S
IkarusTrojan-Ransom.FileCrypter
MAXmalware (ai score=84)
ArcabitTrojan.Ulise.D14D77
MicrosoftTrojan:Win32/Wacatac.B!ml
Acronissuspicious
BitDefenderThetaGen:NN.ZexaF.34080.lnuaaGD9TUkj
ALYacGen:Variant.Ulise.85367
TrendMicro-HouseCallTROJ_GEN.R020H09AB20
SentinelOneDFI – Suspicious PE
eGambitUnsafe.AI_Score_83%
GDataGen:Variant.Ulise.85367
Ad-AwareGen:Variant.Ulise.85367
AVGWin32:Trojan-gen
Cybereasonmalicious.1eac21
AvastWin32:Trojan-gen
Qihoo-360Generic/Trojan.dfd

How to remove Win32/Filecoder.NZY?

Win32/Filecoder.NZY removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment