How to remove “Ursu.149476 (B)”?

The Ursu.149476 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.149476 (B) virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is likely packed with VMProtect
• Authenticode signature is invalid

How to determine Ursu.149476 (B)?

File Info:
name: 50AA2AD2D99ABA0ED99C.mlw
path: /opt/CAPEv2/storage/binaries/75a17285a30b81ed152955031b15a40e0280d02fba7c854c929e02dcdfd05d46
crc32: 8F537602
md5: 50aa2ad2d99aba0ed99c6e0904efa037
sha1: 95000d9c8ee1654116501ecd2d9264027b9f7b56
sha256: 75a17285a30b81ed152955031b15a40e0280d02fba7c854c929e02dcdfd05d46
sha512: dacc63ac0d206a817a11ac6aee780afbff8e768429e672333e9d4c74c03027d4be2a29f6526d733c24cfe18d7f0cf7f31e8b674a1b4ce7f6629bdacffffa1d13
ssdeep: 49152:5JbcHsh9xepq0W0TTHIZTIWTsAd5JgNvM4iO+j:DcGiqYjWIAd5Jy1+j
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T130952337467EA5BAC47C06BD171EBB48CCEEEA31D515916F502425EA8C13AB31CE821F
sha3_384: b9878ba6ed4f8980211bfb861d521ba50754f290fa64684cf61d7cf05a8955767aac58c7b5217052f0dcfa26c6ab94be
ep_bytes: 9cff3424e9ebe6fbff0000496d616765
timestamp: 2016-01-16 04:02:42

Version Info:
FileVersion: 1.0.0.0
ProductVersion: 1.0.0.0
Translation: 0x0409 0x04e4

Ursu.149476 (B) also known as:

How to remove Ursu.149476 (B)?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.