Ursu.214542 removal tips

The Ursu.214542 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.214542 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality

How to determine Ursu.214542?

File Info:
name: 3BEE5FF80E529D78F402.mlw
path: /opt/CAPEv2/storage/binaries/5634ea490a8541434925a27a435d4ab46e14da1e4ee635861f80f09b5a1a95b7
crc32: EDB74C92
md5: 3bee5ff80e529d78f402423f6d1a7974
sha1: 9dc2ca62002cd82c3fac6ef99925149b3d6127f1
sha256: 5634ea490a8541434925a27a435d4ab46e14da1e4ee635861f80f09b5a1a95b7
sha512: 545ff09932d960cd6b257687ee46427895f7cf07d8e69be728608887a0e90a015f10a1107eb2a08a0c002a6261516994525b8bb031bfb6700ed99121f8979bab
ssdeep: 24576:nBWLhKrw4cv+rj+ZTib0+7i1AB2X3Xb/qQ0qFzkYyC96oTttPf3kGF3+jLKT/:wdKrw4cPoyAUXnb/h0fWfJsKz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F9652242B3D701B2F0557AF4C9B980605D177DB815E4617A2CB4FA0E19FA283CD72B9E
sha3_384: eff2a9a4ec5b3e92fdc46512bdbe3c92b600f7a947ecfef78e2f4e44a643ec771e15c70cac2a7cffc9141c68dfe84271
ep_bytes: 558bec83c4a453565733c08945c48945
timestamp: 2016-04-06 14:39:04

Version Info:
Comments: This installation was built with Inno Setup.
CompanyName: HaWi Software                                               
FileDescription: Reminder v.2017.1.30 Setup                                  
FileVersion: 2017.1.30           
LegalCopyright:                                                                                                     
ProductName: Reminder v.2017.1.30                                        
ProductVersion: 2017.1.30                                         
Translation: 0x0000 0x04b0

Ursu.214542 also known as:

How to remove Ursu.214542?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.