Zusy.491576 removal instruction

The Zusy.491576 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.491576 virus can do?

• Sample contains Overlay data
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• Anomalous binary characteristics
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Zusy.491576?

File Info:
name: 0F21DA7BF172C6658793.mlw
path: /opt/CAPEv2/storage/binaries/da5b49ef3842eb8d10a62c30627c210d39c6d5989d69b274a62f302915aaedec
crc32: 8212FC33
md5: 0f21da7bf172c665879311bca5760e1f
sha1: 6e5acc5c967c436627408cdcda6f8418acefafcd
sha256: da5b49ef3842eb8d10a62c30627c210d39c6d5989d69b274a62f302915aaedec
sha512: 735d1b31808a508625b06fae1b9cb4be59cb5157cec5e0cdea4e1f92394f735afba7b08a80cfc3ba0da03d34792e0f0ac64b66e39792966b5aea3bada76ed4af
ssdeep: 196608:ujnie46hvMwJc6KPICCxUlTS/O/vipryDn3sh8/oCTfDMyz3uEsXj0nA:+ieh0wO6ICxODXr5/7XFT2XAA
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T110A62311BBF9C4B5D28A413386595BB690F4FA198E20E8C337C0BF2E6F325D5D139A19
sha3_384: b2e033035b9d64993742cedada25de57c4234951dd2260884c1d28725bf5c655e36113f892c84f04299f6571aa8080b0
ep_bytes: e8e0910000e916feffff558bec51538b
timestamp: 2012-01-16 08:19:32

Version Info:
CompanyName: 平安科技（深圳）有限公司
FileDescription: 离线升级程序_Ver1.0.0.1
FileVersion: 1, 0, 0, 1
InternalName: ESalesPatch.exe
LegalCopyright:  (C) 平安科技（深圳）有限公司。保留所有权利。
OriginalFilename: ESalesPatch.exe
ProductName: 金领离线升级程序
ProductVersion: 1.0.0.1
Translation: 0x0804 0x03a8

Zusy.491576 also known as:

How to remove Zusy.491576?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.