How to remove “Ursu.200689”?

The Ursu.200689 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.200689 virus can do?

Creates RWX memory
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ursu.200689?


File Info:
crc32: CF7947F8
md5: d318b30405750d1c684e658e4a38a933
name: D318B30405750D1C684E658E4A38A933.mlw
sha1: 0808582b7b0c7df5e754820d21f042f1fa23aaf1
sha256: 2f06176b7a7c1b242019bb6f643d22e194eee01a9f582aeac6384fb194d07306
sha512: 9d850b1673d52133cbf6eb4cec45e7e102765685a772204f8be4d24e5fb138fe689f3bb72c87be8def8a7f891338f66ec54ed2a1050f97757930ef226870bf39
ssdeep: 96:46JbC4clhXEpEbvQcZAIKrmsqC8KpenHy7hhlhfJ+W13Iek:4wenvOHfqC8K8nHyJh/C
type: PE32 executable (console) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright:  
Assembly Version: 0.0.0.0
InternalName: cspsvc.exe
FileVersion: 0.0.0.0
ProductVersion: 0.0.0.0
FileDescription:  
OriginalFilename: cspsvc.exe

Ursu.200689 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ursu.200689
FireEye	Gen:Variant.Ursu.200689
ALYac	Gen:Variant.Ursu.200689
Malwarebytes	Trojan.BitCoinMiner
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 00534cc31 )
BitDefender	Gen:Variant.Ursu.200689
K7GW	Trojan ( 00534cc31 )
Cybereason	malicious.405750
BitDefenderTheta	Gen:NN.ZemsilF.34590.am0@aC9oHbf
Cyren	W32/Trojan.CBH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:TrojanX-gen [Trj]
Cynet	Malicious (score: 100)
Kaspersky	Trojan.MSIL.Miner.aim
Alibaba	Trojan:MSIL/Miner.6c499202
Ad-Aware	Gen:Variant.Ursu.200689
Comodo	TrojWare.MSIL.Miner.GU@8ghwjr
F-Secure	Heuristic.HEUR/AGEN.1122408
DrWeb	Trojan.Starter.7713
Zillya	Trojan.Miner.Win32.3678
TrendMicro	Trojan.MSIL.SERVSTAR.SMAA
McAfee-GW-Edition	BehavesLike.Win32.Trojan.xt
Emsisoft	Gen:Variant.Ursu.200689 (B)
Avira	HEUR/AGEN.1122408
Arcabit	Trojan.Ursu.D30FF1
ZoneAlarm	Trojan.MSIL.Miner.aim
GData	Gen:Variant.Ursu.200689
AhnLab-V3	Trojan/Win32.Agent.C2671981
Acronis	suspicious
McAfee	GenericRXFX-YM!D318B3040575
MAX	malware (ai score=86)
Panda	Trj/GdSda.A
ESET-NOD32	a variant of MSIL/Agent.SPP
TrendMicro-HouseCall	Trojan.MSIL.SERVSTAR.SMAA
SentinelOne	Static AI – Suspicious PE
Fortinet	MSIL/Agent.SPP!tr
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win32:TrojanX-gen [Trj]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_80% (W)
Qihoo-360	HEUR/QVM03.0.9AF9.Malware.Gen

How to remove Ursu.200689?

Ursu.200689 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X