Malware

Ursu.160233 removal instruction

Malware Removal

The Ursu.160233 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Ursu.160233 virus can do?

  • SetUnhandledExceptionFilter detected (possible anti-debug)
  • Creates RWX memory
  • Guard pages use detected – possible anti-debugging.
  • Dynamic (imported) function loading detected
  • CAPE extracted potentially suspicious content
  • Authenticode signature is invalid

How to determine Ursu.160233?



File Info:

name: FDEF79ABFBA5FDA3BBA0.mlw
path: /opt/CAPEv2/storage/binaries/b6ddbd2011f37b11474cbb6b1bff161274a6cd41ec6960ed3097c39869c8672c
crc32: 2AE8E064
md5: fdef79abfba5fda3bba033a34c4be3b1
sha1: d015eccd0dfa74debf54ab37664542289c701470
sha256: b6ddbd2011f37b11474cbb6b1bff161274a6cd41ec6960ed3097c39869c8672c
sha512: 25d2d00bab8f67562d0290454d1f5841a06a57c261139ffee4fdeb1b26e8428aea3e0aded086732a0c60c5fbebe20922f238bc316b368ee05a694a32c375792d
ssdeep: 1536:WTaxlwwCO49SGcJTT+Wl5YjdwIMIeQg9VRk1agA6Ob3oxJtl14jFc:SalDbcShJTd5kdz/eRRk1agA6514S
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1E593B47A544C3511CF4DDF77AB0669D9CE9F23D80ECA662B96A885834840BDEEFC09D0
sha3_384: 9501e5532ed3d82ef6448615fa294970888c71df7dbe1b158a766f0f790cdfb2d9601d7c0131ef086cc700081990cdec
ep_bytes: ff250020400000000000000000000000
timestamp: 2018-12-23 19:47:58


Version Info:

Translation: 0x0000 0x04b0
Comments: 
CompanyName: 
FileDescription: Windows Exploler
FileVersion: 1.0.0.0
InternalName: Windows Exploler.exe
LegalCopyright: Copyright ©  2018
LegalTrademarks: 
OriginalFilename: Windows Exploler.exe
ProductName: Windows Exploler
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Ursu.160233 also known as:

Elasticmalicious (high confidence)
MicroWorld-eScanGen:Variant.Ursu.160233
FireEyeGeneric.mg.fdef79abfba5fda3
ALYacGen:Variant.Ursu.160233
CylanceUnsafe
VIPRETrojan.Win32.Generic!BT
K7AntiVirusTrojan ( 005402a21 )
AlibabaBackdoor:MSIL/Disfa.e42dd82f
K7GWTrojan ( 005402a21 )
CrowdStrikewin/malicious_confidence_100% (W)
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of MSIL/Kryptik.QAO
APEXMalicious
Paloaltogeneric.ml
KasperskyHEUR:Trojan.MSIL.Disfa.gen
BitDefenderGen:Variant.Ursu.160233
NANO-AntivirusTrojan.Win32.Disfa.fllybf
AvastWin32:Trojan-gen
TencentMsil.Trojan.Disfa.Eilr
Ad-AwareGen:Variant.Ursu.160233
SophosMal/Generic-S
ComodoMalware@#t8cngjckxg6j
TrendMicroTROJ_GEN.R002C0OKQ21
McAfee-GW-EditionArtemis!Trojan
EmsisoftGen:Variant.Ursu.160233 (B)
SentinelOneStatic AI – Malicious PE
WebrootW32.Trojan.Gen
AviraTR/Dropper.MSIL.Gen
Antiy-AVLTrojan/Generic.ASMalwS.2A24464
MicrosoftBackdoor:MSIL/Bladabindi
GDataGen:Variant.Ursu.160233
CynetMalicious (score: 100)
AhnLab-V3Trojan/Win32.Bladabindi.C2898464
McAfeeArtemis!FDEF79ABFBA5
MAXmalware (ai score=100)
MalwarebytesBackdoor.Bladabindi
TrendMicro-HouseCallTROJ_GEN.R002C0OKQ21
YandexTrojan.Disfa!w6PV7NlqTZo
IkarusTrojan.MSIL.Crypt
eGambitUnsafe.AI_Score_99%
FortinetMSIL/Kryptik.QDB!tr
BitDefenderThetaGen:NN.ZemsilF.34294.fm0@ayYzobg
AVGWin32:Trojan-gen
PandaTrj/GdSda.A
MaxSecureTrojan.Malware.300983.susgen

How to remove Ursu.160233?

Ursu.160233 removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment