How to remove “Ursu.38784”?

The Ursu.38784 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.38784 virus can do?

Creates RWX memory
Attempts to modify proxy settings
Anomalous binary characteristics

How to determine Ursu.38784?


File Info:
crc32: 6EF42854
md5: da68d7bb413e94216a775fa105923e4b
name: DA68D7BB413E94216A775FA105923E4B.mlw
sha1: 1bbc43218b3750eb3c34c328feea1da041d68844
sha256: 0dc384c10b741755d482d90c09d931d70e67b5556c778173e4fe28cde48e0ea2
sha512: 8d171f1d0698ec58c3f6f77b7857fafa58649ddeddd3f7a6af26482fae1def4a68921202dd837f0939da3a260480c9efcd3b7e2f1560dc8cd38bb25a1479f40c
ssdeep: 192:kfswWgF7tSKm6XPiP8CW5lXRbCRgWCSs8YhIrbBmGn9+2jMV88joKy7pqJJ4Eq3:kfXNtSt6/u8D5XCRgWCEY3y788h
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:
0: [No Data]

Ursu.38784 also known as:

K7AntiVirus	Riskware ( 0040eff71 )
MicroWorld-eScan	Gen:Variant.Ursu.38784
ALYac	Gen:Variant.Ursu.38784
Zillya	Trojan.Shelma.Win32.1203
Sangfor	Trojan.Win32.Shelma.wef
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.b413e9
Symantec	ML.Attribute.HighConfidence
Avast	Win32:Malware-gen
Cynet	Malicious (score: 99)
Kaspersky	Trojan.Win32.Shelma.wef
BitDefender	Gen:Variant.Ursu.38784
NANO-Antivirus	Trojan.Win32.Shelma.ewjpbr
Tencent	Win32.Trojan.Shelma.Wsjw
Ad-Aware	Gen:Variant.Ursu.38784
Sophos	Mal/Generic-R + Mal/FakeAV-OZ
Comodo	Malware@#3k29hv1p0sg1l
BitDefenderTheta	Gen:NN.ZexaF.34670.auW@aSncCbji
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.da68d7bb413e9421
Emsisoft	Gen:Variant.Ursu.38784 (B)
Avira	TR/Shelma.xehvt
eGambit	Unsafe.AI_Score_97%
Microsoft	Program:Win32/Wacapew.C!ml
Arcabit	Trojan.Ursu.D9780
ZoneAlarm	Trojan.Win32.Shelma.wef
GData	Gen:Variant.Ursu.38784
AhnLab-V3	Trojan/Win32.Shelma.C2482153
McAfee	Artemis!DA68D7BB413E
MAX	malware (ai score=81)
VBA32	BScope.Trojan.Tiggre
Panda	Trj/GdSda.A
Rising	Trojan.Shelma!8.1A3D (CLOUD)
MaxSecure	Trojan.Malware.11837210.susgen
Fortinet	W32/Shelma.OZ!tr
AVG	Win32:Malware-gen
Qihoo-360	Win32/Ransom.DogHousePower.HgIASQoA

How to remove Ursu.38784?

Ursu.38784 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X