Categories: Malware

How to remove “Win32:Buzus-AYO [Trj]”?

The Win32:Buzus-AYO [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32:Buzus-AYO [Trj] virus can do?

Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Executed a process and injected code into it, probably while unpacking
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Win32:Buzus-AYO [Trj]?


File Info:
crc32: 12C85400md5: 091a61542e7ffc7e2961d73413a278dcname: 091A61542E7FFC7E2961D73413A278DC.mlwsha1: a39a05ec0299e82726bef7f68107e5da570ae3a5sha256: dd221f518f0b103cb6982badbbb4fc0db8abaccb643f6a7b201fbf03538e21besha512: 52a80ff3a7c1d6cac8598791ddce5989225b301e7f1e033b6dd8c1ce8cd60b58f6648ab62bf84bfdc78cfb43d4a49ef2494766e501e1ef87fd8aaa8d2ae479b8ssdeep: 1536:vQlZzpfT+ffRt4CxwgV3W+5yC+FycPHGcGWiLyDl3GZrdy8XRzhSf/JJJT:uZzdUv4C/WMyC+PiWNGltype: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Version Info:
0: [No Data]

Win32:Buzus-AYO [Trj] also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Symmi.8604
Cylance	Unsafe
Sangfor	Suspicious.Win32.Symmi.8604
Cybereason	malicious.42e7ff
Symantec	Trojan.Shylock
APEX	Malicious
Avast	Win32:Buzus-AYO [Trj]
Kaspersky	Trojan-Ransom.Win32.Foreign.nwxo
BitDefender	Gen:Variant.Symmi.8604
NANO-Antivirus	Virus.Win32.Gen.ccmw
MicroWorld-eScan	Gen:Variant.Symmi.8604
Tencent	Win32.Trojan.Foreign.Duw
Ad-Aware	Gen:Variant.Symmi.8604
Sophos	ML/PE-A + Mal/EncPk-AHQ
Comodo	Malware@#enz5molquqim
BitDefenderTheta	Gen:NN.ZexaCO.34170.fGW@a4W!Yshi
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_RANSOM.SMWX
McAfee-GW-Edition	PWS-Zbot.gen.apx
FireEye	Generic.mg.091a61542e7ffc7e
Emsisoft	Gen:Variant.Symmi.8604 (B)
Jiangmin	Trojan/Jorik.fsbj
Webroot	W32.Malware.Gen
Avira	TR/Dropper.Gen8
eGambit	Generic.Malware
Antiy-AVL	Trojan/Generic.ASMalwS.27560C6
Microsoft	Trojan:Win32/Tiggre!rfn
Arcabit	Trojan.Symmi.D219C
ZoneAlarm	Trojan-Ransom.Win32.Foreign.nwxo
GData	Gen:Variant.Symmi.8604
AhnLab-V3	Trojan/Win32.Ransomlock.C2321681
McAfee	PWS-Zbot.gen.apx
MAX	malware (ai score=89)
VBA32	Worm.Dorkbot.1312
Panda	Trj/Ransom.AB
TrendMicro-HouseCall	TROJ_RANSOM.SMWX
Rising	Trojan.Generic@ML.95 (RDML:xT2ivPdasaq+A5e8dnos3w)
Yandex	Trojan.Foreign!V3/28Tq45p0
Ikarus	Trojan-Spy.Win32.Zbot
Fortinet	W32/Sasfis.QYY!tr
AVG	Win32:Buzus-AYO [Trj]
Paloalto	generic.ml