Troj/Ursnif-EX removal guide

The Troj/Ursnif-EX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/Ursnif-EX virus can do?

Executable code extraction
Creates RWX memory
Attempts to connect to a dead IP:Port (10 unique times)
Performs some HTTP requests
Uses Windows utilities for basic functionality
A process attempted to delay the analysis task by a long amount of time.
Creates a hidden or system file
Attempts to modify proxy settings
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

www.bing.com

outlook.com

ocsp.digicert.com

www.outlook.com

outlook.office365.com

gmail.com

dorelunonu.us

www.redtube.com

How to determine Troj/Ursnif-EX?


File Info:
crc32: 3A99714C
md5: 18d613d02eaf8d339feebb21f578f329
name: 18D613D02EAF8D339FEEBB21F578F329.mlw
sha1: 01ea39853139ccfe82f0bd19f8963d3ccebf8e8a
sha256: bd43f7bc23a76b086a81b8e6fcd4355cac648d3f7d9a941d9aa259def534d5b1
sha512: a432ca4267f56530945e2dd352e658d72b3fc84101b84dcd86bc0adcf42e218e394556d6b69cec92cb30a960ce83586e8c026e971f02fa5154d100a198f1e4ce
ssdeep: 12288:CddaT8lLVrp6I7MsfHqWxSWlNTjGoLYTbgOJpXLH:Cddhp1YCMuFx/jGo0XL
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Fingergeneral Corporation. All rights reserved
InternalName: Probable
FileVersion: 5.5.2.216 Sidedone
CompanyName: Fingergeneral Corporation
ProductName: Fingergeneralxae Wear twentyxae
ProductVersion: 5.5.2.216
FileDescription: Fingergeneral Wear twenty
OriginalFilename: turn.dll
Translation: 0x0409 0x04b0

Troj/Ursnif-EX also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
K7GW	Trojan ( 0057bee91 )
K7AntiVirus	Trojan ( 0057bee91 )
ESET-NOD32	a variant of Win32/Kryptik.HKSC
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Trojan.GenericKD.36848210
MicroWorld-eScan	Trojan.GenericKD.36848210
Ad-Aware	Trojan.GenericKD.36848210
Sophos	Troj/Ursnif-EX
Comodo	TrojWare.Win32.UMal.syhyo@0
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Trojan-FTSS!18D613D02EAF
FireEye	Trojan.GenericKD.36848210
Emsisoft	Trojan.GenericKD.36848210 (B)
Avira	TR/AD.UrsnifDropper.zfxje
Microsoft	Trojan:Win32/Wacatac.B!ml
Arcabit	Trojan.Generic.D2324252
GData	Trojan.GenericKD.36848210
AhnLab-V3	Trojan/Win.Generic.R419195
McAfee	Artemis!18D613D02EAF
MAX	malware (ai score=81)
Rising	Trojan.Kryptik!8.8 (CLOUD)
Ikarus	Trojan.Win32.Crypt
Fortinet	W32/Kryptik.HKSC!tr
AVG	Win32:Malware-gen

How to remove Troj/Ursnif-EX?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Troj/Ursnif-EX removal guide