Malware

Zusy.326126 removal instruction

Malware Removal

The Zusy.326126 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Zusy.326126 virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process created a hidden window
  • The binary likely contains encrypted or compressed data.
  • Uses Windows utilities for basic functionality
  • Exhibits behavior characteristic of Cerber ransomware
  • Attempts to execute a binary from a dead or sinkholed URL
  • Writes a potential ransom message to disk
  • Attempts to modify proxy settings
  • Attempts to access Bitcoin/ALTCoin wallets
  • Collects information to fingerprint the system
  • Uses suspicious command line tools or Windows utilities

How to determine Zusy.326126?


File Info:

crc32: 5A48A2FB
md5: bcefae90369a31059ef2d2fe209c0d38
name: BCEFAE90369A31059EF2D2FE209C0D38.mlw
sha1: 2c0beb43c90a72689cdd332fe17dac4f6084e735
sha256: d4b0cca6c2f5cc42b3a4b9e4f21bd20a701013ac62683e5832061bf6b197eb11
sha512: 8856e6dd53337e3a04991d63156a0139e6e1df386902ea8906cf1a2a982e803ed03289d8d2a0b0b009e97671f1b183b5d3923bbb2666034c7d7f30cd3ac8776b
ssdeep: 6144:wyRMl35NOLtqCzzlebJZYOfXnNIyPof/HSMEKD9Z7s:wyRMZHOLtqWMeOFI+a/H3Z7s
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

XXXXXXXXXXXXXXXXXX: ?,x01FileDescription
XXXX: |,x01LegalCopyright
FileVersion: 2.0.6.0
CompanyName: TechSmith Corporation
yright (C) 2005 TechSmith Corporation: X
hSmith Screen Capture Codec Installer: X
Translation: 0x0409 0x04e4

Zusy.326126 also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 005224381 )
Elasticmalicious (high confidence)
DrWebTrojan.Encoder.11198
ClamAVWin.Ransomware.Razy-7001087-0
CAT-QuickHealRansom.Cerber.A4
McAfeeRansomware-CBER!BCEFAE90369A
CylanceUnsafe
ZillyaTrojan.Zerber.Win32.2262
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaRansom:Win32/Cerber.ali1020013
K7GWTrojan ( 005224381 )
Cybereasonmalicious.0369a3
BaiduWin32.Trojan.Kryptik.anp
CyrenW32/Trojan.BAA.gen!Eldorado
SymantecPacked.Generic.459
ESET-NOD32a variant of Win32/Kryptik.FRVT
APEXMalicious
AvastWin32:Filecoder-BG [Trj]
CynetMalicious (score: 100)
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Variant.Zusy.326126
NANO-AntivirusTrojan.Win32.Zerber.eojsmm
MicroWorld-eScanGen:Variant.Zusy.326126
TencentMalware.Win32.Gencirc.10b3ebc6
Ad-AwareGen:Variant.Zusy.326126
ComodoTrojWare.Win32.Ransom.Cerber.EW@73u1y1
BitDefenderThetaGen:NN.ZexaF.34628.Bq0@a4kUtbgi
VIPRETrojan.Win32.Generic!BT
TrendMicroRansom_HPCERBER.SMALY5A
FireEyeGeneric.mg.bcefae90369a3105
EmsisoftGen:Variant.Zusy.326126 (B)
JiangminTrojan.Generic.ebotd
AviraTR/Crypt.ZPACK.Gen7
eGambitUnsafe.AI_Score_100%
MicrosoftRansom:Win32/Cerber.K
GDataGen:Variant.Zusy.326126
AhnLab-V3Win-Trojan/Cerber.Exp
Acronissuspicious
VBA32BScope.Trojan.Encoder
MAXmalware (ai score=84)
MalwarebytesCerber.Ransom.Encrypt.DDS
PandaTrj/Genetic.gen
TrendMicro-HouseCallRansom_HPCERBER.SMALY5A
RisingTrojan.Kryptik!1.AD41 (CLASSIC)
YandexTrojan.GenAsa!/WCeL/kwHbY
SentinelOneStatic AI – Malicious PE
FortinetW32/Kryptik.HGZD!tr
AVGWin32:Filecoder-BG [Trj]
Qihoo-360Win32/Ransom.Cerber.HxQBEpsA

How to remove Zusy.326126?

Zusy.326126 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment