About “Ursu.779592” infection

The Ursu.779592 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.779592 virus can do?

Authenticode signature is invalid

How to determine Ursu.779592?


File Info:
name: 023CCF65F356AD61C91D.mlw
path: /opt/CAPEv2/storage/binaries/ecd6bb75aef8567eb08e2a26c2beff27a2699374652d2b8ba0ae990b0b8b257c
crc32: 88403DA7
md5: 023ccf65f356ad61c91d54f33416dd5f
sha1: dfe4a5af559951797cd41b3cd632e03a6309ff6b
sha256: ecd6bb75aef8567eb08e2a26c2beff27a2699374652d2b8ba0ae990b0b8b257c
sha512: e5b04e8d5e72c4a2d70947e1dac3344e59dc438a8d94985d5779aae8e01bd58ee7da98ad6bb32f7f6f43d05f897b27bb740a3b640e689903bcbcd51ebb8572a8
ssdeep: 384:39/4k1pzT/zuNmj6Bf4kqwRft7O8+ov19sHmpCc2bcJJQH9bcKYHPoQdVAdC+lxD:39/trG0o4Zp8L9BCchA9ck0+lx/eAem
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F0E2390273AC9736DAAE0B7B5973525153B1F2139A03C35938DE05AA2B673614B42BD3
sha3_384: b4acb442909ed51a8d7431d7a663a8487679645f4d4919d96ec2a8dbfeca00666bbd142b2fc5e05fbb24edb4718c5b53
ep_bytes: ff250020001100000000000000000000
timestamp: 2014-11-03 20:52:35

Version Info:
Translation: 0x0000 0x04b0
FileDescription: Client Server Runtime Process
FileVersion: 1.0.5420.41177
InternalName: csrss (32 біти).exe
LegalCopyright:  
OriginalFilename: csrss (32 біти).exe
ProductVersion: 1.0.5420.41177
Assembly Version: 1.0.5420.41177

Ursu.779592 also known as:

Bkav	W32.AIDetectMalware.CS
Lionic	Trojan.Win32.Keylogger.4!c
Elastic	malicious (moderate confidence)
MicroWorld-eScan	Gen:Variant.Ursu.779592
FireEye	Generic.mg.023ccf65f356ad61
Skyhigh	BehavesLike.Win32.Infected.nt
ALYac	Gen:Variant.Ursu.779592
Cylance	unsafe
Zillya	Trojan.Kryptik.Win32.833738
Sangfor	Spyware.Msil.KeyLogger.Vjd4
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	Trojan:MSIL/KeyLogger.ecdd7927
K7GW	Spyware ( 004db2971 )
K7AntiVirus	Spyware ( 004db2971 )
BitDefenderTheta	Gen:NN.ZemsilF.36744.cm0@auLmDck
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Spy.Keylogger.BGJ
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Ursu.779592
NANO-Antivirus	Trojan.Win32.Keylogger.hofxsy
Tencent	Malware.Win32.Gencirc.140058eb
Emsisoft	Gen:Variant.Ursu.779592 (B)
F-Secure	Trojan.TR/Spy.KeyLogger.cbaqd
VIPRE	Gen:Variant.Ursu.779592
TrendMicro	TROJ_GEN.R002C0OB824
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Spy
Google	Detected
Avira	TR/Spy.KeyLogger.cbaqd
Antiy-AVL	Trojan/Win32.Ymacco
Xcitium	Malware@#52tlck76iwsz
Arcabit	Trojan.Ursu.DBE548
ViRobot	Trojan.Win32.Z.Keylogger.32768.ABA
ZoneAlarm	UDS:DangerousObject.Multi.Generic
GData	Gen:Variant.Ursu.779592
AhnLab-V3	Malware/Win32.RL_Generic.C4130527
McAfee	Artemis!023CCF65F356
MAX	malware (ai score=85)
DeepInstinct	MALICIOUS
VBA32	Trojan.Ymacco
Malwarebytes	Generic.Malware/Suspicious
TrendMicro-HouseCall	TROJ_GEN.R002C0OB824
Rising	Spyware.Keylogger!8.12F (CLOUD)
Yandex	TrojanSpy.Keylogger!/+9thJ+HIDw
MaxSecure	Trojan.Malware.1728101.susgen
Fortinet	MSIL/Keylogger.BGJ!tr.spy
Panda	Trj/GdSda.A

How to remove Ursu.779592?

Ursu.779592 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X