Should I remove “Zusy.495909”?

The Zusy.495909 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Zusy.495909 virus can do?

• A file was accessed within the Public folder.
• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Korean
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Zusy.495909?

File Info:
name: FC6905042C4DD9A7DEA6.mlw
path: /opt/CAPEv2/storage/binaries/41d136b095f71333d6f5777d7bd13df10d38b443f894de115f44d54b0163fef3
crc32: 6060EF5C
md5: fc6905042c4dd9a7dea637f51bcb5bf1
sha1: fee923b72c72bbcd70bc414a278ced7545d4ca7c
sha256: 41d136b095f71333d6f5777d7bd13df10d38b443f894de115f44d54b0163fef3
sha512: 0eecd94dd69f6ccdc6d545709dc52a627c45bc5aea5c949e8c448db7d805556f9d31a16eafdd0405e55b603e89fb7986b9445af8c9d7aec9f6eb7065074be8dc
ssdeep: 196608:ngvRvoeemJDqML94V1mlz7jwaXSAXpTDjC8sv0POn:gJv4ImVMlzfXj5DumOn
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1008633582AF01412F4042CB7B303DE92AA6D7511DE5D928FD633EAF4B9112FEE770296
sha3_384: 014066839bff729c0b102eaaa7d976d5db104700e6d860e5b3000584797daa41f57027b6b27b548d28c12948508013db
ep_bytes: 60be008041008dbe0090feff57eb0b90
timestamp: 2012-12-31 00:38:51

Version Info:
CompanyName: Sejin Chun
FileDescription: Image & Animation Viewer
FileVersion: 1.1.9
InternalName: Imagine
LegalCopyright: Copyright (c) 2003-2023 Sejin Chun
ProductName: Imagine
ProductVersion: 1.1.9
Translation: 0x0000 0x04b0

Zusy.495909 also known as:

How to remove Zusy.495909?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.