How to remove “Trojan:Win32/Urelas!pz”?

The Trojan:Win32/Urelas!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Urelas!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Unconventionial language used in binary resources: Korean
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities to create a scheduled task
• CAPE detected the shellcode get eip malware family
• Deletes executed files from disk
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Trojan:Win32/Urelas!pz?

File Info:
name: 801FA04A3CC9CB0FC9AC.mlw
path: /opt/CAPEv2/storage/binaries/f21dc4fd11e5146b2701b135163befa439638b668e253c8c712fd04fd7d097da
crc32: 5C00CA59
md5: 801fa04a3cc9cb0fc9ac35a7d1091ac8
sha1: 7e78f00b4428ab54efd63e01c064957f055dadf6
sha256: f21dc4fd11e5146b2701b135163befa439638b668e253c8c712fd04fd7d097da
sha512: 7b4462b0a793c73f4d3e0cd070bb35291713344edb1e380e631e7f17e039461a92c64f20c3aa5b79edc25928299777fc9d44e852715f9c7d4fb8fb19a1062f44
ssdeep: 12288:yPd8fBT+RkEulOYyZCnWjXjJsj3C1WW8lTJ0:yIp+RFuDyZCnUzJsG1WW8lF0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T174A4E02A7BC04826D3694B3E55D7D3B19B1BDDB91094820FD168FB746E313930A632BE
sha3_384: 52d2f2a24886f81f0d12c45cda1d7cd8bf01d372759d55e7dde30f50641c75ca5f53db5a4a4317f77aed03837aea955b
ep_bytes: b85c4b48005064ff3500000000648925
timestamp: 2013-08-23 13:23:01

Version Info:
0: [No Data]

Trojan:Win32/Urelas!pz also known as:

How to remove Trojan:Win32/Urelas!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.