Ursu.257483 removal guide

The Ursu.257483 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.257483 virus can do?

Presents an Authenticode digital signature
Creates RWX memory
Unconventionial binary language: Portuguese (Brazil)
Unconventionial language used in binary resources: Portuguese (Brazilian)
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

www.drcsistemas.com

a.tomx.xyz

How to determine Ursu.257483?


File Info:
crc32: 7BF0E4E9
md5: 4243665aba240de3b7f3c256057db26b
name: down.exe
sha1: 687b6a83bedecb7268b34a24c3eee4f24133d561
sha256: 97d285b3db682054c4b897136bda2615392a4d949de16214160cf0578f44302e
sha512: 49db0b737fa38e68f256a31e7f7aa448c46dc6109291536a37f4535c176b1739bc17489f14d5d94e920a0290a4382a3770392357c8942d8f3e4c127f911fd7c7
ssdeep: 6144:blhwg26eRNEOQ2DxswJlsaCa+yoRwfzeTOs1NDVZch/S3OG2:bl6J6+NEOQ2Di41r/kwqdDDX+G2
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: 
InternalName: 
FileVersion: 2.1.0.1
CompanyName: DRC SISTEMAS
LegalTrademarks: 
Comments: 
ProductName: 
ProductVersion: 2.1.0.1
FileDescription: DOWNLOAD DOS APLICATIVOS DO SISTEMA
OriginalFilename: 
Translation: 0x0416 0x04e4

Ursu.257483 also known as:

MicroWorld-eScan	Gen:Variant.Ursu.257483
FireEye	Generic.mg.4243665aba240de3
McAfee	Artemis!4243665ABA24
Cylance	Unsafe
Sangfor	Malware
BitDefender	Gen:Variant.Ursu.257483
Cybereason	malicious.aba240
BitDefenderTheta	Gen:NN.ZelphiF.34090.umLfambrjbjG
Cyren	W32/Trojan.TYKO-8656
TrendMicro-HouseCall	TROJ_GEN.R002H09LE19
Avast	Win32:Malware-gen
GData	Gen:Variant.Ursu.257483
AegisLab	Trojan.Win32.Ursu.4!c
APEX	Malicious
Ad-Aware	Gen:Variant.Ursu.257483
McAfee-GW-Edition	Artemis!Trojan
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Ursu.257483 (B)
MaxSecure	Trojan.Malware.74796215.susgen
MAX	malware (ai score=99)
Antiy-AVL	GrayWare/Win32.Uwamson
Endgame	malicious (moderate confidence)
Arcabit	Trojan.Ursu.D3EDCB
Microsoft	Trojan:Win32/Occamy.C
Acronis	suspicious
VBA32	suspected of Trojan.Notifier.gen
ALYac	Gen:Variant.Ursu.257483
Rising	Malware.Heuristic!ET#94% (RDMK:cmRtazq4YtMpOlx4OotZ9nylnfAp)
Ikarus	Trojan.Win32.Qhost
AVG	Win32:Malware-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_70% (W)
Qihoo-360	HEUR/QVM11.1.056B.Malware.Gen

How to remove Ursu.257483?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.