Should I remove “Ursu.279284”?

The Ursu.279284 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.279284 virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ursu.279284?


File Info:
crc32: A2A0B914
md5: 9ec11aed7c0fe1d8976c65ef9907ba2a
name: 9EC11AED7C0FE1D8976C65EF9907BA2A.mlw
sha1: 0c4216cd16f61605e2ad836a9fc43d653ab51243
sha256: 02f5bb63bd6ba2e27a1ebcc3c02d5c677d0c6a06fd97cb26e8775b8929d79a6f
sha512: 70c4de75e86818b9026accb724c298ca1dc6a8903348909ef28aa7fe975e407f3617568d2d1e0f1000cdebc1456bdfc99cf03ec526610ee8cc2d20e94951b747
ssdeep: 6144:8B+pgUHuSEIn1aI2mxy04za0og1WEM+HUwrzDaHOMasCNXjZd:8gndnooR4za0og1PvH3aHOZdNXdd
type: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive

Version Info:
LegalCopyright: (c) 2018 Polarity Technologies Ltd
FileVersion: 2.30.0.1
CompanyName: Polarity Technologies Ltd
ProductName: Desktop Search Bar
ProductVersion: 2.30.0.1
FileDescription: Desktop web search
OriginalFilename: SBInstaller
Translation: 0x0409 0x0000

Ursu.279284 also known as:

K7AntiVirus	Riskware ( 0040eff71 )
Lionic	Adware.Win32.InstaFast.2!c
Elastic	malicious (high confidence)
DrWeb	Adware.Spigot.149
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ursu.279284
Cylance	Unsafe
Zillya	Tool.WebToolbar.Win32.36
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	AdWare:Win32/InstaFast.5d890161
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.d7c0fe
Symantec	Trojan.Gen.6
APEX	Malicious
Avast	Win32:AdwareSig [Adw]
ClamAV	Win.Trojan.Generic-6931301-0
Kaspersky	not-a-virus:HEUR:AdWare.Win32.InstaFast.gen
BitDefender	Gen:Variant.Ursu.279284
MicroWorld-eScan	Gen:Variant.Ursu.279284
Tencent	Win32.Adware.Instafast.Hyjp
Ad-Aware	Gen:Variant.Ursu.279284
Sophos	BrowserIO (PUA)
Comodo	Application.Win32.BrowserIO.C@7v8oon
McAfee-GW-Edition	BehavesLike.Win32.Browser.dc
FireEye	Generic.mg.9ec11aed7c0fe1d8
Emsisoft	Gen:Variant.Ursu.279284 (B)
SentinelOne	Static AI – Malicious PE
Avira	ADWARE/SearchSetter.vzbiu
Antiy-AVL	Trojan/Generic.ASMalwS.34C4FE3
Microsoft	Program:Win32/Occamy.AA
Arcabit	Trojan.Ursu.D442F4
GData	Gen:Variant.Ursu.279284
AhnLab-V3	PUP/Win32.WebToolbar.R241845
Acronis	suspicious
MAX	malware (ai score=87)
VBA32	Adware.InstaFast
Malwarebytes	Adware.BrowserIO
Panda	Trj/CI.A
Yandex	PUA.InstaFast!R31EjpR0e7A
AVG	Win32:AdwareSig [Adw]

How to remove Ursu.279284?

Ursu.279284 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X