Should I remove “TrojanDownloader:O97M/Ursnif.ARJ!MTB”?

The TrojanDownloader:O97M/Ursnif.ARJ!MTB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What TrojanDownloader:O97M/Ursnif.ARJ!MTB virus can do?

Injection (inter-process)
Uses Windows utilities for basic functionality
Network activity detected but not expressed in API logs

How to determine TrojanDownloader:O97M/Ursnif.ARJ!MTB?


File Info:
crc32: 53BB6DE7
md5: 19f03c53e2dd224a6006db9824f90140
name: vbaProject.bin
sha1: 96af64a5cf8c72742eaace8c1425edd92652b4eb
sha256: 5cef2f75ea169e63ef3af3683233976bce0c229d9678d52ed7892ca2be31aa23
sha512: b974fe59819b9f937b6a5c9d7502a677cff3981065a7e66049e9fd99b8d59b3386c4ca7d5b9a2be7e148e43e587334d86d2d99a4920e18022a4a2f90ba3409bd
ssdeep: 384:ivLqrJZx913wWxqdc+3CwbsHy0HUK5DT74LrJO50jA9UvttEo2KGa1KB:UL2T/0c+3CwAHVl74OJ9Ro2KGa1KB
type: Composite Document File V2 Document, No summary info

Version Info:
0: [No Data]

TrojanDownloader:O97M/Ursnif.ARJ!MTB also known as:

DrWeb	W97M.Opener.3
MicroWorld-eScan	VB:Trojan.Valyria.3221
FireEye	VB:Trojan.Valyria.3221
McAfee	RDN/Generic Downloader.x
Sangfor	Malware
Arcabit	HEUR.VBA.Trojan.d
Avast	Other:Malware-gen [Trj]
ClamAV	Doc.Malware.Generic-7898874-0
Kaspersky	HEUR:Trojan-Downloader.MSOffice.SLoad.gen
BitDefender	VB:Trojan.Valyria.3221
NANO-Antivirus	Trojan.Ole2.Vbs-heuristic.druvzi
Tencent	Win32.Trojan-downloader.Agent.Ecay
Endgame	malicious (high confidence)
F-Secure	Malware.VBA/Dldr.Agent.laxew
Emsisoft	VB:Trojan.Valyria.3221 (B)
Ikarus	Trojan-Downloader.VBA.Valak
Avira	VBA/Dldr.Agent.laxew
Antiy-AVL	Trojan[Downloader]/MSOffice.Agent.swh
Microsoft	TrojanDownloader:O97M/Ursnif.ARJ!MTB
AegisLab	Trojan.MSWord.Generic.4!c
ZoneAlarm	HEUR:Trojan-Downloader.MSOffice.SLoad.gen
GData	VB:Trojan.Valyria.3221
Cynet	Malicious (score: 85)
AhnLab-V3	Downloader/DOC.Generic.S1227
ALYac	VB:Trojan.Valyria.3221
Ad-Aware	VB:Trojan.Valyria.3221
ESET-NOD32	a variant of VBA/TrojanDownloader.Agent.SWH
Rising	Macro.Downloader.r (CLASSIC)
SentinelOne	DFI – Malicious OLE
Fortinet	W32/Agent.SWH!tr.dldr
AVG	Other:Malware-gen [Trj]
Qihoo-360	Generic/Trojan.Downloader.3f4

How to remove TrojanDownloader:O97M/Ursnif.ARJ!MTB?

TrojanDownloader:O97M/Ursnif.ARJ!MTB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X