How to remove “Zusy.413698”?

The Zusy.413698 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.413698 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid

How to determine Zusy.413698?

File Info:
name: E32489E44458F6B0B888.mlw
path: /opt/CAPEv2/storage/binaries/7f2e22d4ac0869d8ff23ec3d47e49982910a8212c13ffcd10fd0e5e4c31a933c
crc32: 08AB56CD
md5: e32489e44458f6b0b888fb5a39b0bf6a
sha1: 8e8d2564ee4b8d2c2381f6567a250f163463d574
sha256: 7f2e22d4ac0869d8ff23ec3d47e49982910a8212c13ffcd10fd0e5e4c31a933c
sha512: e7343ce755039f2b13d8bab74b36eab4e4a384acd00dbaf8d461d622fda5b04bebacb89442e92f6340559d3f00b6a9cae7814ba18bb182289e3ef278ccd4e727
ssdeep: 3072:PZH+Nn351N+RlNkHK3w4KEJ7oc6TFbijsxKxjaR9VBi98exyNTWibSyeeXI5Xr:RHInbs173wfksKxOR5i/T04eXIZ
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16324CF13B210D07AC45AE532E375CDF309626CDDA275250B2FA83E797F727E0992934A
sha3_384: 9ab21e7ca436b611c6688cb5177371cd08fdee1484125f38c357c36fbf43207912705ed7df9a853509b32151211f140f
ep_bytes: e8aa290000e989feffff8bff558bec83
timestamp: 2011-12-13 19:23:31

Version Info:
CompanyName: LSI Systems
FileDescription: SQL Console
FileVersion: 3.0.1.5
InternalName: SQL Console
LegalCopyright: Copyright (C) 2006 - 2011 LSI Systems
OriginalFilename: SQL Client Program
ProductName: SQL Client Program
ProductVersion: 3.0.1.5
Translation: 0x0409 0x04b0

Zusy.413698 also known as:

How to remove Zusy.413698?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.