Win32/Spy.KeyLogger.OCU removal tips

The Win32/Spy.KeyLogger.OCU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.KeyLogger.OCU virus can do?

Unconventionial language used in binary resources: Turkish
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Creates a copy of itself

How to determine Win32/Spy.KeyLogger.OCU?


File Info:
name: 4E513FC370730EF094CD.mlw
path: /opt/CAPEv2/storage/binaries/a1ab36cec4ba2597ffe9d74b8501b2c5f96ca1039988def17f90f01b9f2ef633
crc32: 539E1763
md5: 4e513fc370730ef094cdaf8ecd144c4c
sha1: fdc6b2e0d57d6b3776d4d023319f3bfea794f3c2
sha256: a1ab36cec4ba2597ffe9d74b8501b2c5f96ca1039988def17f90f01b9f2ef633
sha512: 1bf3094280857691f792cf3d94e30a952ea1d6107d7fe17513d1d1bc0c5158527edd4cd9e1ec2a4b575089869041c37107eb4310b49dc47481141f66f631ead4
ssdeep: 6144:inwxsgX9nEbDeeZ1VnKX30FjFc1xcmJRpoh+nnrMKPZpljmYPpZ2wlm:lmOVEbD/n+kbc19JHohenXpkYPpowl
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T135A46D37B2E19437D1231B78CC2B5BA89D2ABE502D38A4463BE51F4C5F396817927393
sha3_384: f08a7114c1bfade6ddbb1d0e4050fa9143260b20edbc741ae33427c3a846582e9ef908fcde86c55c51e58a57e5645105
ep_bytes: 558bec83c4f0b828724600e88cf4f9ff
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: 
FileDescription: 
FileVersion: 1.0.0.0
InternalName: 
LegalCopyright: 
LegalTrademarks: 
OriginalFilename: 
ProductName: 
ProductVersion: 1.0.0.0
Comments: 
Translation: 0x041f 0x04e6

Win32/Spy.KeyLogger.OCU also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Qyslfg.4!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Trojan.SMTP-Mailer.DG0@a4qYSLfG
McAfee	RDN/Generic PWS.y
Malwarebytes	Generic.Malware/Suspicious
Zillya	Trojan.Keylogger.Win32.77276
Sangfor	Spyware.Win32.KeyLogger.Vgsw
K7AntiVirus	Spyware ( 000fcaa11 )
Alibaba	TrojanSpy:Win32/KeyLogger.2ea88502
K7GW	Spyware ( 000fcaa11 )
CrowdStrike	win/malicious_confidence_60% (W)
Symantec	Trojan.Gen.MBT
ESET-NOD32	a variant of Win32/Spy.KeyLogger.OCU
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Spy.Win32.KeyLogger.gen
BitDefender	Gen:Trojan.SMTP-Mailer.DG0@a4qYSLfG
NANO-Antivirus	Trojan.Win32.KeyLogger.jupuos
Avast	Win32:Trojan-gen
Tencent	Win32.Trojan-Spy.Keylogger.Dflw
Emsisoft	Gen:Trojan.SMTP-Mailer.DG0@a4qYSLfG (B)
F-Secure	Trojan.TR/Spy.KeyLogger.tkppd
VIPRE	Gen:Trojan.SMTP-Mailer.DG0@a4qYSLfG
McAfee-GW-Edition	BehavesLike.Win32.ObfuscatedPoly.gh
Trapmine	malicious.moderate.ml.score
FireEye	Gen:Trojan.SMTP-Mailer.DG0@a4qYSLfG
Sophos	Mal/Keylog-A
Ikarus	Trojan-PWS.Win32.Gestron
GData	Gen:Trojan.SMTP-Mailer.DG0@a4qYSLfG
Google	Detected
Avira	TR/Spy.KeyLogger.tkppd
MAX	malware (ai score=87)
Antiy-AVL	Trojan[Spy]/Win32.KeyLogger
Arcabit	Trojan.SMTP-Mailer.E2CA7A
ZoneAlarm	HEUR:Trojan-Spy.Win32.KeyLogger.gen
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 99)
BitDefenderTheta	Gen:NN.ZelphiF.36196.DG0@a4qYSLfG
ALYac	Gen:Trojan.SMTP-Mailer.DG0@a4qYSLfG
Cylance	unsafe
Panda	Trj/Chgt.AD
Rising	Trojan.Generic@AI.90 (RDML:sN2m2JDQ1uWOyWznxFm6zA)
Fortinet	PossibleThreat.SB!tr.bdr
AVG	Win32:Trojan-gen
Cybereason	malicious.370730
DeepInstinct	MALICIOUS

How to remove Win32/Spy.KeyLogger.OCU?

Win32/Spy.KeyLogger.OCU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X