Categories: Malware

How to remove “Zusy.316873”?

The Zusy.316873 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.316873 virus can do?

Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Unconventionial language used in binary resources: Russian
The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine Zusy.316873?


File Info:
name: BA791DA114450F35E548.mlwpath: /opt/CAPEv2/storage/binaries/ba7a0a98a1b19a4fed5bfad02f8ddf51419cbd7033ac1b76c2a11c6345476066crc32: 4757B0A5md5: ba791da114450f35e548d5458a9e4b4esha1: b21c330160d2f4a92eab5fd13f3e87261d037d3asha256: ba7a0a98a1b19a4fed5bfad02f8ddf51419cbd7033ac1b76c2a11c6345476066sha512: 1b97a6cb686b06e78c078bea89c1daf692f0db1576734dddc4bd622e44098339f892d72c0eb0aad4d45481e7bad515570e6a23af67dcc257e82c6b002393a79fssdeep: 49152:0XCFg1V/0CTIvOUzGv4FGSXWsl6bsWaxT4474UlzqzqXKCUEwCJURb2Vv4Aij:0XFTsFzV86ZXKCUEwxb2VQACtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T10E369E337389653ED1EE1E399927D214993FB6223A52CC5B6BF80D4C0E76640793BA07sha3_384: 4041a7f9df2a990e71f2b2eb2a5f89896803f312d81a2ef2c0f215f917f80c445b2709b7e45ad5d68977852d2e37979fep_bytes: 558bec83c4f0535657b8bcd17300e839timestamp: 2016-05-19 04:01:31
Version Info:
CompanyName: .CompanyNameFileVersion: 1.0.0.1205InternalName: .InternalNameLegalCopyright: .LegalCopyrightLegalTrademarks: .LegalTrademarksOriginalFilename: .OriginalFilenameProductName: .ProductNameProductVersion: 1.0.0.0Comments: .CommentsTranslation: 0x0409 0x04e4

Zusy.316873 also known as:

Lionic	Adware.Win32.Generic.2!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.316873
FireEye	Generic.mg.ba791da114450f35
McAfee	Artemis!BA791DA11445
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Adware ( 004efef41 )
BitDefender	Gen:Variant.Zusy.316873
K7GW	Adware ( 004efef41 )
Cybereason	malicious.114450
Symantec	SMG.Heur!gen
ESET-NOD32	a variant of Win32/DLBoost.HO potentially unwanted
APEX	Malicious
Paloalto	generic.ml
Kaspersky	not-a-virus:HEUR:AdWare.Win32.Generic
Alibaba	AdWare:Win32/DLBoost.81fc228d
Ad-Aware	Gen:Variant.Zusy.316873
Emsisoft	Gen:Variant.Zusy.316873 (B)
DrWeb	Trojan.InstallMonster.1507
Zillya	Adware.DLBoost.Win32.142
TrendMicro	TROJ_GEN.R002C0OL421
McAfee-GW-Edition	BehavesLike.Win32.MultiPlug.th
Sophos	Generic ML PUA (PUA)
Jiangmin	AdWare.Generic.tbqn
Avira	HEUR/AGEN.1136586
MAX	malware (ai score=87)
Antiy-AVL	Trojan/Generic.ASMalwS.132C762
Gridinsoft	Ransom.Win32.Wacatac.sa
Microsoft	Trojan:Win32/Wacatac.A!ml
GData	Gen:Variant.Zusy.316873
Cynet	Malicious (score: 99)
VBA32	BScope.Adware.InstallMonster
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_GEN.R002C0OL421
Yandex	Riskware.Agent!nDproxOibTo
SentinelOne	Static AI – Suspicious PE
eGambit	Unsafe.AI_Score_97%
Fortinet	Riskware/DLBoost
AVG	Win32:LoadMoney-AKS [Adw]
Avast	Win32:LoadMoney-AKS [Adw]
CrowdStrike	win/malicious_confidence_100% (D)