Categories: Malware

How to remove “Zusy.301914”?

The Zusy.301914 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.301914 virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Deletes its original binary from disk
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Creates a hidden or system file
Creates a copy of itself
Harvests credentials from local FTP client softwares
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

marroiq.com

How to determine Zusy.301914?


File Info:
crc32: B5B23EE5md5: 3a26dbb6dfc0513cf46cffea6e83835aname: billiz.exesha1: 2cfafa672cbb5c5a48edc45b2454998ea4332ab7sha256: 7a178eb5af773199f14ca84ceaf1d67d8b4a615c215d04ab3c763e61e2ad7456sha512: 87598d302f9989e2579c5860aabdf83b01701b3dd828f45b4bb2c5f0a3c5617b20d525db903c073366a2468efb2b035b86b3e54c896093c38061d5d910003910ssdeep: 12288:9gOdoGRmJnRojvmWsNfPeU3rLXetqzaubp1xVDNjcyVw:KuoGInRoiWsJeKLXcq11hNYyVwtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: xa9 20onww.fsf.org>InternalName: m4FileVersion: 1.4License: This promokyleft/lesser.html. CompanyName: Gnet>LegalTrademarks: Gnxae,m4xaeWWW: http:/are/m4ProductName: MProductVersion: 127FileDescription: M4xorocessorOriginalFilename: m.s2eTranslation: 0x0409 0x04e4

Zusy.301914 also known as:

MicroWorld-eScan	Gen:Variant.Zusy.301914
FireEye	Generic.mg.3a26dbb6dfc0513c
Qihoo-360	HEUR/QVM05.1.B703.Malware.Gen
McAfee	Fareit-FSK!3A26DBB6DFC0
Cylance	Unsafe
BitDefender	Gen:Variant.Zusy.301914
K7GW	Trojan ( 00564fdd1 )
CrowdStrike	win/malicious_confidence_70% (D)
BitDefenderTheta	Gen:NN.ZelphiF.34106.KG0@a4YhKjei
Cyren	W32/Trojan.KIGM-3551
GData	Gen:Variant.Zusy.301914
Kaspersky	HEUR:Trojan-PSW.Win32.Agensla.gen
APEX	Malicious
Tencent	Win32.Backdoor.Fareit.Auto
Ad-Aware	Gen:Variant.Zusy.301914
Sophos	Mal/Fareit-V
DrWeb	Trojan.PWS.Stealer.28391
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Fareit.hc
Trapmine	malicious.moderate.ml.score
Emsisoft	Gen:Variant.Zusy.301914 (B)
SentinelOne	DFI – Suspicious PE
F-Prot	W32/Trojan2.QBVM
Webroot	W32.Trojan.Gen
MAX	malware (ai score=86)
Endgame	malicious (high confidence)
Arcabit	Trojan.Zusy.D49B5A
ZoneAlarm	HEUR:Trojan-PSW.Win32.Agensla.gen
Microsoft	Trojan:Win32/Wacatac.C!ml
AhnLab-V3	Suspicious/Win.Delphiless.X2059
Acronis	suspicious
ALYac	Gen:Variant.Zusy.301914
Malwarebytes	Trojan.MalPack.DLF.Generic
ESET-NOD32	a variant of Win32/Injector.ELNW
Rising	Trojan.Injector!8.C4 (TFE:dGZlOgW5o9imTBLjmA)
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.ELKP!tr
Cybereason	malicious.72cbb5
Paloalto	generic.ml