Ursu.200441 removal

The Ursu.200441 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.200441 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• A process attempted to delay the analysis task.
• Dynamic (imported) function loading detected
• Enumerates running processes
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Maori
• Authenticode signature is invalid
• Detects Avast Antivirus through the presence of a library
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup

How to determine Ursu.200441?

File Info:
name: 5ADFE62D0873FA595B34.mlw
path: /opt/CAPEv2/storage/binaries/d1a882b498859c0fcc99bedd7607bf1f769ac6ded71eee0e71686bab918e6e1d
crc32: CE2A6D3C
md5: 5adfe62d0873fa595b34e9aa2b2154b5
sha1: 81fbe85c66170ba5d1770507932fc5dd96dc3ecf
sha256: d1a882b498859c0fcc99bedd7607bf1f769ac6ded71eee0e71686bab918e6e1d
sha512: fbaeaf532cf830361e6ed6d8ff42a8542749e018190ea22cad625ffa4c9a5b4b116295ece452dc27c6875f4c22e7a49f2bd23f6224e5a55114b5e631cf76cb92
ssdeep: 3072:cfOAfLQgtv9hbh4LoNrx2lJd4wD/hTLdP49HsK4W8/:E1624D5T5P49r8/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DE143B35899899F6C736C9B9CF2615E9B2C07C3735058C8ACB5A150A09F3E4B7BC1B0B
sha3_384: ea3c7a42f8dfe89fe033a55d03e2012a098e9c4ebf309c912b46b1d373bed0a572f3002b7c188120a8d30308d5cdc991
ep_bytes: 681c154000e8f0ffffff000000000000
timestamp: 2012-09-29 08:07:43

Version Info:
CompanyName: Simon Tatham
ProductName: PuTTY suite
FileDescription: SSH, Telnet and Rlogin client
InternalName: PuTTY
OriginalFilename: PuTTY
FileVersion: Release 0.62
ProductVersion: Release 0.62
LegalCopyright: Copyright © 1997-2011 Simon Tatham.
Translation: 0x0809 0x04b0

Ursu.200441 also known as:

How to remove Ursu.200441?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.