Zusy.406809 information

The Zusy.406809 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.406809 virus can do?

A process created a hidden window
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Uses Windows utilities for basic functionality
Network activity detected but not expressed in API logs
Uses suspicious command line tools or Windows utilities

Related domains:

pic.baixiongz.com

ocsp.digicert.com

How to determine Zusy.406809?


File Info:
crc32: 035CF67F
md5: cf09fa8f99facdddde1dcc27df98c775
name: CF09FA8F99FACDDDDE1DCC27DF98C775.mlw
sha1: f47dbf794f3dcf1d9ecd8544c46f9bcdc8a2fd63
sha256: 7558a8c13e51f7367a92783272300e6a1936df8ce9c1902cc4a9a7d245953106
sha512: 5d7699b034ac073486e2d264e00c5f55a3b6f7f49630e90a36a1fae3c86bd728a1afb88c59bdd61328d42e77bf4007a68df7d7a2fdf92e82b368e7c0b9c98027
ssdeep: 12288:4+LMdILv1mpNCMl5lj0tNxecqBVH0jwIA77Y:4YMSLwJ0tN8HvwA78
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x7248x6743x6240x6709 (C) 2002
InternalName: EastDraw
FileVersion: 1, 0, 0, 1
CompanyName: 
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: EastDraw x5e94x7528x7a0bx5e8f
SpecialBuild: 
ProductVersion: 1, 0, 0, 1
FileDescription: EastDrawx5e94x7528x7a0bx5e8f
OriginalFilename: EastDraw.EXE
Translation: 0x0804 0x04b0

Zusy.406809 also known as:

K7AntiVirus	Trojan-Downloader ( 005768c81 )
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader43.63473
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Zusy.406809
CrowdStrike	win/malicious_confidence_80% (W)
K7GW	Trojan-Downloader ( 005768c81 )
Cybereason	malicious.94f3dc
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FMQ
APEX	Malicious
Avast	Win32:BackdoorX-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.Zenpak.gen
BitDefender	Gen:Variant.Zusy.406809
MicroWorld-eScan	Gen:Variant.Zusy.406809
Ad-Aware	Gen:Variant.Zusy.406809
McAfee-GW-Edition	GenericRXQI-HH!CF09FA8F99FA
FireEye	Gen:Variant.Zusy.406809
Emsisoft	Gen:Variant.Zusy.406809 (B)
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Arcabit	Trojan.Zusy.D63519
GData	Gen:Variant.Zusy.406809
AhnLab-V3	Trojan/Win.HH.R449867
McAfee	GenericRXQI-HH!CF09FA8F99FA
MAX	malware (ai score=84)
VBA32	BScope.Trojan.Agentb
Malwarebytes	Malware.AI.1904694489
Panda	Trj/GdSda.A
Ikarus	Trojan-Downloader.Win32.Agent
AVG	Win32:BackdoorX-gen [Trj]

How to remove Zusy.406809?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.