Zusy.189044 removal tips

The Zusy.189044 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Zusy.189044 virus can do?

Reads data out of its own binary image
Drops a binary and executes it
Authenticode signature is invalid
Creates a copy of itself
Deletes executed files from disk

How to determine Zusy.189044?


File Info:
name: 1B085F0296C78C20D8EF.mlw
path: /opt/CAPEv2/storage/binaries/7f6d8d8ac3c098af78b6fc18fce52efd75cf08abd8c0d459ee0b1bd38d7e3d09
crc32: 3B85BD41
md5: 1b085f0296c78c20d8efa8a63b1f29fa
sha1: d60236bc52d63b0c48e8cc25745b78777711b97e
sha256: 7f6d8d8ac3c098af78b6fc18fce52efd75cf08abd8c0d459ee0b1bd38d7e3d09
sha512: fc21fcbab9d7d318266fb76efb8a5796ed2f11d470b87ee988445c372cc308c8e7d4b15764e598b130ef8db6465c593fbb69e32eaa07acb59a94291a21321be0
ssdeep: 12288:xbT77uxXTkrdiHSbSt2OYzkIb/bD4aHZvSPEFRNw:NT7SxXTinut2O0kUf9ZvkW
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B1C49D10B58392B3D8A208F3416DE63A1A357D761F1D8BE3EBDB4E0659F61909733263
sha3_384: 948813159342305e907a1fce8125cf84ef2a8dcde964bea25d0d701a93ec9c272b28cdbb072a813bde9f6a936bdf468e
ep_bytes: e846ee0000e9000000006a1468204a48
timestamp: 2014-11-07 12:22:59

Version Info:
0: [No Data]

Zusy.189044 also known as:

Bkav	W32.FamVT.BRTTc.Worm
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.189044
ClamAV	Win.Trojan.Emotet-6748801-0
FireEye	Generic.mg.1b085f0296c78c20
CAT-QuickHeal	Trojan.Bayrob.G3
McAfee	Trojan-FINB!1B085F0296C7
Malwarebytes	Trojan.Bayrob.Generic
VIPRE	Gen:Variant.Zusy.189044
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 004dc2a31 )
K7GW	Trojan ( 004dc2a31 )
Cybereason	malicious.296c78
BitDefenderTheta	AI:Packer.D8E772221E
Cyren	W32/Nivdort.L.gen!Eldorado
Symantec	Trojan.Bayrob!gen8
ESET-NOD32	a variant of Win32/Bayrob.CS
APEX	Malicious
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Bayrob.gen
BitDefender	Gen:Variant.Zusy.189044
NANO-Antivirus	Trojan.Win32.Bayrob.eciqun
Avast	Win32:TrojanX-gen [Trj]
Emsisoft	Gen:Variant.Zusy.189044 (B)
Baidu	Win32.Trojan.Bayrob.a
F-Secure	Trojan:W32/Bayrob.F
DrWeb	Trojan.Bayrob.57
Zillya	Trojan.SwizzorGen.Win32.1
TrendMicro	TROJ_BAYROB.SM7
McAfee-GW-Edition	Trojan-FINB!1B085F0296C7
Trapmine	malicious.high.ml.score
Sophos	Mal/Bayrob-C
Ikarus	Trojan.Win32.Bayrob
GData	Gen:Variant.Zusy.189044
Jiangmin	Trojan.Bayrob.wlu
Avira	TR/Nivdort.Gen2
Antiy-AVL	Trojan/Win32.Bayrob
Arcabit	Trojan.Zusy.D2E274
ViRobot	Trojan.Win32.Agent.571392.A
ZoneAlarm	HEUR:Trojan.Win32.Bayrob.gen
Microsoft	TrojanSpy:Win32/Nivdort
Google	Detected
AhnLab-V3	Trojan/Win32.Agent.C1386802
VBA32	SScope.Malware-Cryptor.Bayrob
ALYac	Gen:Variant.Zusy.189044
MAX	malware (ai score=89)
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_BAYROB.SM7
Rising	Malware.Undefined!8.C (TFE:5:Or875fC033G)
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Bayrob.BT!tr
AVG	Win32:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove Zusy.189044?

Zusy.189044 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X