Categories: Malware

Zusy.291105 removal tips

The Zusy.291105 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.291105 virus can do?

Executable code extraction
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Creates a hidden or system file
Network activity detected but not expressed in API logs
Creates a copy of itself
Created a service that was not started

How to determine Zusy.291105?


File Info:
crc32: AB5206AFmd5: de0de343952bb5407e933a7cfcb20805name: heilaosan1.exesha1: e7bd7cdb5edb4dcd9707b4c445d5cd97cc9cfd5asha256: 684ffc8c6669974f964f27d5eed514753c5e2f50cf8fa8968d6bd92121cf92a5sha512: 4d1f0fd3f73a53db0a16b63d2ac26e86cbd29f5a706a8112123a9f2409ae1546b7efb1bd031bef39e99a1cd6b30d0bc3458b76bea2a036ee467346ede4177d15ssdeep: 3072:gMgFAfsJH2a15jM3p4VC6RaOob6/kANH7P/LJmyASxmpYCcwnIFxSI3iSiP1dJr:Z1fCHBM3p4VC6RiOTNH7bJmyXxxTFxftype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
0: [No Data]

Zusy.291105 also known as:

MicroWorld-eScan	Gen:Variant.Zusy.291105
FireEye	Generic.mg.de0de343952bb540
Qihoo-360	HEUR/QVM11.1.C775.Malware.Gen
McAfee	GenericRXAA-AA!DE0DE343952B
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Trojan ( 005206491 )
BitDefender	Gen:Variant.Zusy.291105
K7GW	Trojan ( 005206491 )
Cybereason	malicious.3952bb
TrendMicro	BKDR_ZEGOST.SM30
F-Prot	W32/Zegost.DH
APEX	Malicious
Avast	Win32:Malware-gen
GData	Gen:Variant.Zusy.291105
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	Backdoor:Win32/Farfli.095828ec
NANO-Antivirus	Trojan.Win32.Wsgame.felits
AegisLab	Trojan.Win32.Generic.4!c
Tencent	Malware.Win32.Gencirc.10b0c33c
Ad-Aware	Gen:Variant.Zusy.291105
Sophos	Troj/AutoG-FL
Comodo	TrojWare.Win32.Dialer.AFXP@4pjm0a
F-Secure	Heuristic.HEUR/AGEN.1101568
DrWeb	Trojan.PWS.Wsgame.52797
Zillya	Trojan.Generic.Win32.163562
Invincea	heuristic
McAfee-GW-Edition	BackDoor-FDKM!5F780EC1ECB8
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Zusy.291105 (B)
Ikarus	Trojan.Win32.Dialer
Cyren	W32/Zegost.SXPI-1792
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1101568
Antiy-AVL	Trojan/Win32.AGeneric
Endgame	malicious (moderate confidence)
Arcabit	Trojan.Zusy.D47121
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	Trojan:Win32/Skeeyah.A!MTB
AhnLab-V3	Backdoor/Win32.Zegost.C2864528
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34108.lmGfa4kmc1bO
ALYac	Gen:Variant.Zusy.291105
MAX	malware (ai score=82)
VBA32	Trojan.Agentb
Zoner	Trojan.Win32.75143
ESET-NOD32	Win32/Farfli.CGU
TrendMicro-HouseCall	BKDR_ZEGOST.SM30
Rising	Trojan.Kryptik!1.C00E (CLOUD)
Yandex	Trojan.Agent!tS8S9A9oi6k
SentinelOne	DFI – Suspicious PE
Fortinet	W32/Farfli.BUL!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)
MaxSecure	Trojan.Malware.7164915.susgen