Should I remove “Ursu.192763”?

The Ursu.192763 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.192763 virus can do?

Executable code extraction
Creates RWX memory
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Creates a copy of itself

How to determine Ursu.192763?


File Info:
crc32: 2E6FB78B
md5: b67ecd73e78137c84196e80e740d9e33
name: B67ECD73E78137C84196E80E740D9E33.mlw
sha1: 287fb236a4385f01a0b4a92e293dcf550f70043c
sha256: ae9dbf3beace1bda198bd1438411d3f63c9881c8ae358b7972cfe459fbe088a3
sha512: a3deb24e2c285244e389e4acf47c3bfd31b49b7f631834dd7d616ea79fececa8111c5c96242f695f3413ad9e51c2856d60c0510123fbec539592d521a40c9ae9
ssdeep: 12288:hnyg/lNbNUnidcr7MeipoAPLUuMiivdKsnY:Hbmwcr7MDPA
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
LegalCopyright: Copyright 1999-2012 Firefox and Mozzilla developers. All rights reserved.
Assembly Version: 1.2.3
InternalName: TLB.exe
FileVersion: 1.2
CompanyName: 
LegalTrademarks: Guerra
Comments: 
ProductName: Scriptchecker
ProductVersion: 1.1
FileDescription: Script Checker
OriginalFilename: Script Checker TLB
Translation: 0x0000 0x04b0

Ursu.192763 also known as:

K7AntiVirus	Trojan ( 0053fc801 )
Elastic	malicious (high confidence)
DrWeb	Trojan.MulDrop8.17120
Cynet	Malicious (score: 100)
ALYac	Trojan.Ransom.Jigsaw
Cylance	Unsafe
Zillya	Dropper.Generic.Win32.7168
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
K7GW	Trojan ( 0053fc801 )
Cybereason	malicious.3e7813
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	multiple detections
APEX	Malicious
Avast	Win32:PWSX-gen [Trj]
Kaspersky	HEUR:Trojan-Banker.MSIL.BitStealer.gen
BitDefender	Gen:Variant.Ursu.192763
NANO-Antivirus	Trojan.Win32.Confuser.faxzvt
MicroWorld-eScan	Gen:Variant.Ursu.192763
Tencent	Win32.Trojan.Generic.Pfji
Ad-Aware	Gen:Variant.Ursu.192763
Sophos	Mal/Generic-R + Mal/MSIL-SX
Comodo	Malware@#kugjj1k3emr
BitDefenderTheta	Gen:NN.ZemsilF.34758.Lm0@aCSyJfo
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
FireEye	Generic.mg.b67ecd73e78137c8
Emsisoft	Gen:Variant.Ursu.192763 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan.Generic.ccoqe
Avira	TR/Dropper.MSIL.pgmzg
eGambit	Unsafe.AI_Score_100%
Microsoft	Ransom:MSIL/JigsawLocker.A
GData	Gen:Variant.Ursu.192763
AhnLab-V3	Trojan/Win32.Ransomlock.C2487098
McAfee	Artemis!B67ECD73E781
MAX	malware (ai score=99)
Malwarebytes	MachineLearning/Anomalous.96%
Panda	Trj/GdSda.A
Yandex	Trojan.Agent!wljVvGbJZkU
Ikarus	Trojan.MSIL.NanoCore
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Generic.SX!tr
AVG	Win32:PWSX-gen [Trj]
Paloalto	generic.ml

How to remove Ursu.192763?

Ursu.192763 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X