Should I remove "Ursu.32449"?

The Ursu.32449 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.32449 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
A process attempted to delay the analysis task.
A process created a hidden window
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Sniffs keystrokes
Steals private information from local Internet browsers
Installs itself for autorun at Windows startup
Creates a copy of itself
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients
Anomalous binary characteristics

Related domains:

aol.com

mail.sdjosierjoiejfc.com

apple.i-tunes.download

How to determine Ursu.32449?


File Info:
crc32: 50C54682
md5: 46954b97ebfb252c1a7876bdd7dce811
name: 46954B97EBFB252C1A7876BDD7DCE811.mlw
sha1: 3a1fb4e7dcec0e4072cb4595202b034e654a5f2e
sha256: f896d3b6469578727929732761cce18a3534b9842ab1f504c1372968fa6d6faf
sha512: 64264b1dbc3c083bde5a7978a0d2527245b4db4b5c76b69835cad746d1c419ca2c52344d79c07ff9be165e0cdaa3389ca82f90a0860c40917f74f9bcc10e3747
ssdeep: 6144:SMJzDfVDH+sf6qzkyLZF1O2EZLvExxjcixs+XNhkA6GSaRXfy1n2e:vDfpH+sfnz1Lj1OZZs4ixsiNhkApRa
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: 2005-2017 TC & Co
InternalName: TCstatus
FileVersion: 5.0.2.4
CompanyName: TC & Co
LegalTrademarks: TC & Co
Comments: TCstatus
ProductName: TCstatus v5.0
ProductVersion: 5.0.2.4
FileDescription: TC status
OriginalFilename: TCstatus.exe
Translation: 0x0409 0x04e4

Ursu.32449 also known as:

K7AntiVirus	Trojan ( 7000000f1 )
Lionic	Trojan.Win32.Blocker.tqvm
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader14.35508
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Ursu.32449
Cylance	Unsafe
Zillya	Trojan.Blocker.Win32.39516
Sangfor	Trojan.Win32.Save.a
Alibaba	Ransom:Win32/Blocker.123f2809
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.7ebfb2
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/PSW.Delf.ORL
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	Trojan-Ransom.Win32.Blocker.klsu
BitDefender	Gen:Variant.Ursu.32449
NANO-Antivirus	Trojan.Win32.Blocker.evekkx
MicroWorld-eScan	Gen:Variant.Ursu.32449
Tencent	Malware.Win32.Gencirc.11495444
Ad-Aware	Gen:Variant.Ursu.32449
Sophos	Mal/Generic-S
Comodo	Malware@#1zkie79rkg7x6
BitDefenderTheta	AI:Packer.0465D07E16
VIPRE	Trojan.Win32.Generic.pak!cobra
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
FireEye	Generic.mg.46954b97ebfb252c
Emsisoft	Gen:Variant.Ursu.32449 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan/Generic.bfgib
Avira	TR/Crypt.ZPACK.Gen
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.240F951
Microsoft	PWS:Win32/Zbot!ml
GData	Gen:Variant.Ursu.32449
AhnLab-V3	Trojan/Win32.Blocker.C2273292
McAfee	GenericRXDH-AG!46954B97EBFB
MAX	malware (ai score=98)
VBA32	Trojan-Ransom.Blocker
Malwarebytes	Malware.AI.1466725513
Panda	Trj/GdSda.A
Yandex	Trojan.GenAsa!EiI03eFRHU0
Ikarus	Trojan.Win32.Virtumonde
Fortinet	W32/Blocker.KLSU!tr
AVG	Win32:Malware-gen

How to remove Ursu.32449?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Should I remove “Ursu.32449”?