Should I remove “Zusy.402225”?

The Zusy.402225 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.402225 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Scheduled file move on reboot detected
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Behavioural detection: Transacted Hollowing
• Created a process from a suspicious location
• Steals private information from local Internet browsers
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Likely virus infection of existing system binary
• Created a service that was not started

How to determine Zusy.402225?

File Info:
name: 4B217D9080CFEB11EAB6.mlw
path: /opt/CAPEv2/storage/binaries/27b3221fbf4785a8f9252f8b696d78fa9f65878a17c23c99f17de1ceb0692367
crc32: 5D5A1FB3
md5: 4b217d9080cfeb11eab63653593848c3
sha1: 18141b054788a3dbcacfdae1b89da5b39a7d2730
sha256: 27b3221fbf4785a8f9252f8b696d78fa9f65878a17c23c99f17de1ceb0692367
sha512: 4c9ff443672bb279936d4f3cc15cd665b507dae973ce3b5b14bac917b47b9df53c1b3fc3083d833476a7b07ccb7c26d69b5d64e866ee52f96cb7cb9a2d532c49
ssdeep: 49152:I4iRFgx41IhafW2FXVQRN5Ldy2dzN1PJr11CirVw+h:0vkElCN6aNJz1hVH
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19C850113A6C1C13EC02148B5FD0312FD5526DE51A922ACB762FF7D2B3E396C36A0959B
sha3_384: 9ecbfad3d21564a1b9fdb2c09dd993a9d85c67e8f6fcc5150ee3cb61e46bbe55fa8d1a0b72783ad500e4007a30a09647
ep_bytes: 558bec6aff68d077570068e451570064
timestamp: 2021-09-18 04:27:19

Version Info:
0: [No Data]

Zusy.402225 also known as:

How to remove Zusy.402225?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.