Malware

What is “Ser.Ursu.22642”?

Malware Removal

The Ser.Ursu.22642 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ser.Ursu.22642 virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Reads data out of its own binary image
  • A process created a hidden window
  • A scripting utility was executed
  • Uses Windows utilities for basic functionality
  • Installs itself for autorun at Windows startup
  • Anomalous binary characteristics
  • Uses suspicious command line tools or Windows utilities

How to determine Ser.Ursu.22642?



File Info:

crc32: 86F62F58
md5: 3bea1383eaad4c012d18bce7cef75126
name: win7fix.exe
sha1: c9b7e4e5b747f1071db2e2ed535cb4c4a3145139
sha256: f3147998738e35b3887f073c9708835ab4d2b9fca567ac8755fbd76ab4112a79
sha512: 69ae0de4d68bc0c8902ab9be07ee968b3e18a28e3144e831b44c480ff4e096b24d22c49a172df0de77534915e5369455c8429d230faa66c548f4b877d1f844ab
ssdeep: 49152:Fsjf6Eit8li7Y4S1e5o+B4w6SL8ANNtVlY/DpWjBp7f4iQIkxfaI1gMMEm1Q:F8Cz88Y4gIBp6SLXJVlKyNkMI3nCQ
type: PE32 executable (GUI) Intel 80386, for MS Windows


Version Info:

LegalCopyright: all rights reserved
FileVersion: 1.4.7.1
CompanyName: lib pack archive march
LegalTrademarks: symantec company all rights
Comments: lib pack archive march
ProductName: lib pack 2020
Translation: 0x0409 0x04e4

Ser.Ursu.22642 also known as:

BkavHW32.Packed.
MicroWorld-eScanGen:Variant.Ser.Ursu.22642
FireEyeGen:Variant.Ser.Ursu.22642
McAfeeArtemis!3BEA1383EAAD
MalwarebytesTrojan.Injector.NSIS.Generic
AegisLabTrojan.Win32.Scrami.4!c
SangforMalware
K7AntiVirusTrojan ( 005528ea1 )
BitDefenderGen:Variant.Ser.Ursu.22642
K7GWTrojan ( 005528ea1 )
SymantecML.Attribute.HighConfidence
ESET-NOD32PowerShell/RA-based.A
APEXMalicious
AvastWin32:Trojan-gen
ClamAVWin.Malware.Score-6931191-0
GDataGen:Variant.Ser.Ursu.22642
KasperskyHEUR:Trojan.Win32.Scrami.gen
AlibabaTrojan:Win32/Scrami.91b8bfb0
NANO-AntivirusTrojan.Win32.Scrami.hgfmdj
Endgamemalicious (high confidence)
SophosMal/Generic-S
F-SecureHeuristic.HEUR/AGEN.1110754
DrWebTrojan.Siggen9.22697
ZillyaTrojan.Scrami.Win32.361
Invinceaheuristic
EmsisoftGen:Variant.Ser.Ursu.22642 (B)
CyrenW32/Trojan.UTGH-3334
AviraHEUR/AGEN.1110754
MAXmalware (ai score=99)
MicrosoftTrojan:Win32/Occamy.C
ArcabitTrojan.Ser.Ursu.D5872
ZoneAlarmHEUR:Trojan.Win32.Scrami.gen
ALYacGen:Variant.Ser.Ursu.22642
Ad-AwareGen:Variant.Ser.Ursu.22642
PandaTrj/CI.A
RisingTrojan.ScriptRunner/NSIS!1.BD6D (CLASSIC)
FortinetNSIS/Agent.C!tr
AVGWin32:Trojan-gen
Paloaltogeneric.ml
CrowdStrikewin/malicious_confidence_100% (W)
Qihoo-360Win32/Trojan.02c

How to remove Ser.Ursu.22642?

Ser.Ursu.22642 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment