Zusy.306993 removal guide

The Zusy.306993 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.306993 virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Unusual version info supplied for binary

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Zusy.306993?


File Info:
crc32: 99C23DA1
md5: 46eee44cac2e74b3bfc23d613ffa3432
name: 319a01938abgs.exe
sha1: 617c9e73261daf157d92bf3a7737134a35e62462
sha256: 57694a4c3886364f935a6570a88aef8e05b3579200e37cc7cb5a463ae5554aa8
sha512: 88ae2f87f2887d90c6bd510daa7b42b331ef6c061492986566c9924c969126d7953452ce9888b58d6b7081aac86b8396a31ad14729b57c9121f083bd29c1127a
ssdeep: 6144:gIWQeCCxoCa4EzEuP3K95X0H2kOU3vkjD8m3BZbyqP2X/I:gIWQsoCaJr/Kjo8jD8EP2A
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: BthCxn.exe
FileVersion: 6.0.6000.16384
CompanyName: Windows (R) Codename Longhorn DDK provider
ProductName: Windows (R) Codename Longhorn DDK driver
ProductVersion: 6.0.6000.16384
FileDescription: Bluetooth Connection Sample Application
OriginalFilename: BthCxn.exe
Translation: 0x0409 0x04b0

Zusy.306993 also known as:

Bkav	W32.AIDetectVM.malwareB
DrWeb	Trojan.Packed.140
MicroWorld-eScan	Gen:Variant.Zusy.306993
McAfee	GenericRXAA-AA!46EEE44CAC2E
Cylance	Unsafe
Sangfor	Malware
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Zusy.306993
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
TrendMicro	Mal_Cerber-23
BitDefenderTheta	Gen:NN.ZexaF.34128.uu1@aGTj4nai
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/TrickBot.CR
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Trojan:Application/TrickBot.91d48ce4
Tencent	Malware.Win32.Gencirc.119893b9
Endgame	malicious (high confidence)
Emsisoft	Gen:Variant.Zusy.306993 (B)
F-Secure	Trojan.TR/AD.TrickBot.pjhaw
Invincea	heuristic
McAfee-GW-Edition	Artemis!Trojan
Trapmine	suspicious.low.ml.score
FireEye	Generic.mg.46eee44cac2e74b3
Sophos	Mal/Generic-S
SentinelOne	DFI – Malicious PE
Avira	TR/AD.TrickBot.pjhaw
Fortinet	W32/Trickbot.HEEV!tr
Antiy-AVL	Trojan/Win32.Wacatac
Arcabit	Trojan.Zusy.D4AF31
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/TrickBot.ARJ!MTB
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Trickbot.R340882
ALYac	Gen:Variant.Mikey.113712
MAX	malware (ai score=84)
Ad-Aware	Gen:Variant.Zusy.306993
Malwarebytes	Trojan.TrickBot
TrendMicro-HouseCall	Mal_Cerber-23
Rising	Malware.Undefined!8.C (CLOUD)
GData	Gen:Variant.Zusy.306993
AVG	Win32:Malware-gen
Cybereason	malicious.3261da
Avast	Win32:Malware-gen
Qihoo-360	HEUR/QVM41.1.02FB.Malware.Gen

How to remove Zusy.306993?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.