How to remove “Ursu.801126 (B)”?

The Ursu.801126 (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.801126 (B) virus can do?

Executable code extraction
Creates RWX memory
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Ursu.801126 (B)?


File Info:
crc32: 52AEEB3E
md5: d1a8742ba0dd5101a0632ae9110bd011
name: D1A8742BA0DD5101A0632AE9110BD011.mlw
sha1: d04f0111ba08bfd556d4240fe5c4916b8b6757ea
sha256: f7fb8fe4a3502379aa0852f17ed2889e25aa702e037ff3581c7d9ac29e705883
sha512: 38c5aaa8e5840792e706e3d09a341236684a77772a138ac219e34603a6dc12e9a4a044321b76be633c3c443570b828d8392ef179f32dd8cf2491abf5607314ba
ssdeep: 384:vqQqPSUAN5YIEId1araLk245nuoX/V5yQHxQXWG:vq9WfYIzxn
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 Microsoft 2020
Assembly Version: 1.0.0.0
InternalName: WindowsApplication60.exe
FileVersion: 1.0.0.0
CompanyName: Microsoft
ProductName: WindowsApplication60
ProductVersion: 1.0.0.0
FileDescription: WindowsApplication60
OriginalFilename: WindowsApplication60.exe

Ursu.801126 (B) also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Ursu.801126
FireEye	Generic.mg.d1a8742ba0dd5101
ALYac	Gen:Variant.Ursu.801126
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Generic.mfHD
Sangfor	Malware
K7AntiVirus	Trojan-Downloader ( 004c41161 )
BitDefender	Gen:Variant.Ursu.801126
K7GW	Trojan-Downloader ( 004c41161 )
Cybereason	malicious.ba0dd5
Cyren	W32/Trojan.DOMA-5805
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Trojan-gen
Alibaba	Trojan:MSIL/Generic.964ab13a
NANO-Antivirus	Trojan.Win32.Comet.idwsxo
Ad-Aware	Gen:Variant.Ursu.801126
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Dldr.Tiny.fjimh
DrWeb	BackDoor.Comet.3422
Zillya	Downloader.Tiny.Win32.18702
McAfee-GW-Edition	Artemis
Emsisoft	Gen:Variant.Ursu.801126 (B)
Ikarus	Trojan-Downloader.MSIL.Tiny
Avira	TR/Dldr.Tiny.fjimh
Microsoft	HackTool:Win32/AutoKMS!ml
Arcabit	Trojan.Ursu.DC3966
GData	Gen:Variant.Ursu.801126
Cynet	Malicious (score: 100)
McAfee	Artemis!D1A8742BA0DD
MAX	malware (ai score=83)
Malwarebytes	Generic.Malware/Suspicious
ESET-NOD32	a variant of MSIL/TrojanDownloader.Tiny.BB
TrendMicro-HouseCall	TROJ_GEN.R014H09L720
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	MSIL/Tiny.LG!tr.dldr
BitDefenderTheta	Gen:NN.ZemsilF.34804.bq0@a0QMPfi
AVG	Win32:Trojan-gen
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/Trojan.5e9

How to remove Ursu.801126 (B)?

Ursu.801126 (B) removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X