About “Zusy.501914” infection

The Zusy.501914 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Zusy.501914 virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid

How to determine Zusy.501914?


File Info:
name: D3092F4759D3CAAAD1FE.mlw
path: /opt/CAPEv2/storage/binaries/51c89e5edfb54b5fbd6eb9f91e6eced378727cf6fef1204903e9a7095085dffc
crc32: 4C82C525
md5: d3092f4759d3caaad1fe9f486ceddead
sha1: 227a2c4f0de76324e99b52d186ffd5c681d21b5e
sha256: 51c89e5edfb54b5fbd6eb9f91e6eced378727cf6fef1204903e9a7095085dffc
sha512: 5cdcd550d2987088e8f6b03f10cb0441131ff0930c4163594d44b6ca37af83cf956b8b8400cb8693b2bdde1b3a11ea89127ea99f637c8d7a8ec4543ecfd4d45f
ssdeep: 12288:xG5NyXzknmyWRPrHG5Y+2NFYRZS4Iv6WNNoGU4YkHFqLKrah2sFaKFOXfQJOmOuO:gsjGmTRPrkYny0N5YxXUP
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T198357C11B6838C72D9A5193104E5E777D721CE840B238BC3775CFD5A3F32AC26E2A656
sha3_384: 41838c36dc935b0186b175b10883645a1cba2b798e8ad6224b516b9c757b8da67517234431dec50b670160e6e108d00c
ep_bytes: 558bec6aff6870f14d0068f4fc460064
timestamp: 2012-07-14 13:27:54

Version Info:
FileVersion: 1.0.0.0
FileDescription: by：498990334
ProductName: 易语言程序
ProductVersion: 1.0.0.0
LegalCopyright: 作者版权所有 请尊重并使用正版
Comments: 本程序使用易语言编写(http://www.eyuyan.com)
Translation: 0x0804 0x04b0

Zusy.501914 also known as:

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Generic.lwoF
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Zusy.501914
FireEye	Generic.mg.d3092f4759d3caaa
CAT-QuickHeal	Risktool.Flystudio.16886
Skyhigh	BehavesLike.Win32.Generic.th
McAfee	Artemis!D3092F4759D3
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Trojan.Win32.FlyStudio.Vtyw
BitDefender	Gen:Variant.Zusy.501914
Cybereason	malicious.f0de76
BitDefenderTheta	Gen:NN.ZexaF.36792.gr0@auxshpcb
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Packed.FlyStudio.AA potentially unwanted
APEX	Malicious
Rising	Trojan.Generic@AI.100 (RDML:75/PRia+DmsLB3qD2+W46w)
Sophos	Generic Reputation PUA (PUA)
F-Secure	Trojan:W32/DelfInject.R
VIPRE	Gen:Variant.Zusy.501914
Trapmine	suspicious.low.ml.score
Emsisoft	Application.Generic (A)
Ikarus	PUA.FlyStudio
Google	Detected
Varist	W32/OnlineGames.HG.gen!Eldorado
Antiy-AVL	Trojan/Win32.FlyStudio.a
Kingsoft	malware.kb.a.934
Microsoft	Trojan:Win32/Emotet!ml
Xcitium	Worm.Win32.Dropper.RA@1qraug
Arcabit	Trojan.Zusy.D7A89A
GData	Win32.Trojan.PSE.15IBL0F
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Zusy.501914
MAX	malware (ai score=84)
DeepInstinct	MALICIOUS
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002H0CJJ23
SentinelOne	Static AI – Malicious PE
MaxSecure	Dropper.Dinwod.frindll
AVG	Win32:MalwareX-gen [Trj]
Avast	Win32:MalwareX-gen [Trj]
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Zusy.501914?

Zusy.501914 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X