Ursu.651223 removal guide

The Ursu.651223 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.651223 virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Ursu.651223?


File Info:
name: 86462D215B22402F3BBF.mlw
path: /opt/CAPEv2/storage/binaries/8564ea4ddc90bb6e44c9183033df762b174d745d66d795e9d06c009bec482106
crc32: 1F44B7F7
md5: 86462d215b22402f3bbf3c06c6d54646
sha1: f0322a71a7da665e51435ac5e0b930b116497087
sha256: 8564ea4ddc90bb6e44c9183033df762b174d745d66d795e9d06c009bec482106
sha512: 461050c81410528ec70851d6709f44e36f5a1bb12ed2f011f2924eec7f68ae85dbecdb01b767c5ab3cac1731a607f1f57cc04fc4d484626a729aebb37d153a5b
ssdeep: 768:0VRdB/ija+1IG13yBl0elcrh89DqbcRG0l6iGivO8OmqRhj5TEtb/3A95bCAIOw2:0VRC3cXlcVU48yRhjNExuVCAIOwnzp1Q
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19E138D63E9C08771E0B90AF848E6524DE53BBA322805E7EB26DD1C6D8F96354345C1DF
sha3_384: 271883283606efd69e7dd8639f511f8de6399f680e078ddbad8f5e22e43be26b1a3f7994f7d99b498ddf45f933f414c5
ep_bytes: 558bec83c4f05356b81c8c4000e806b1
timestamp: 2012-02-16 14:16:26

Version Info:
0: [No Data]

Ursu.651223 also known as:

Bkav	W32.AIDetectMalware
MicroWorld-eScan	Gen:Variant.Ursu.651223
FireEye	Gen:Variant.Ursu.651223
ALYac	Gen:Variant.Ursu.651223
Cybereason	malicious.15b224
Arcabit	Trojan.Ursu.D9EFD7
Elastic	malicious (high confidence)
APEX	Malicious
Kaspersky	HEUR:Trojan-Downloader.Win32.Agent.gen
BitDefender	Gen:Variant.Ursu.651223
Emsisoft	Gen:Variant.Ursu.651223 (B)
F-Secure	Heuristic.HEUR/AGEN.1325720
VIPRE	Gen:Variant.Ursu.651223
Trapmine	suspicious.low.ml.score
Avira	HEUR/AGEN.1325720
ZoneAlarm	HEUR:Trojan-Downloader.Win32.Agent.gen
GData	Gen:Variant.Ursu.651223
Cynet	Malicious (score: 99)
MAX	malware (ai score=88)
Malwarebytes	MachineLearning/Anomalous.94%
Rising	Trojan.Generic@AI.89 (RDML:TdXw0WUzLMjdfwVuDJqXMg)
BitDefenderTheta	Gen:NN.ZelphiF.36318.cKW@aiaJN!d
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_70% (D)

How to remove Ursu.651223?

Ursu.651223 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X