Should I remove "Ursu.811664"?

The Ursu.811664 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.811664 virus can do?

Creates RWX memory
A process attempted to delay the analysis task.
Drops a binary and executes it
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time
Installs itself for autorun at Windows startup
Collects information about installed applications
Creates a hidden or system file
Checks for the presence of known devices from debuggers and forensic tools
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ursu.811664?


File Info:
crc32: 5E58CC20
md5: ab79f25eb651355944e5c348467a7f11
name: printershare2401.exe
sha1: 7d7a3bdb10473ff4bdc436966d053528cb9fae88
sha256: cf8ed424dadb018fb06a8e7fc96c0cbdec93a0e2c672a1e4e9f2615f43650cc7
sha512: 97e06b6cb6930834fd1efa7768e302350c22608aa36220d5f40ae888a5c59c926c7cda3d6ae82e2b8008933741505ab0bc7ed520d09761038961d9a595304c00
ssdeep: 196608:jxRn4doAew7vjYDely85h5hFCRaVqWVe0APBPYzE4jxs3CoVsPs5CX+9pxCecds:3m4W8DQ35xYcuUjxs3NsPs5CX+9mdre
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Wextract                
FileVersion: 11.00.18362.356 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
ProductVersion: 11.00.18362.356
FileDescription: Win32 Cabinet Self-Extractor                                           
OriginalFilename: WEXTRACT.EXE            .MUI
Translation: 0x0409 0x04b0

Ursu.811664 also known as:

MicroWorld-eScan	Gen:Variant.Ursu.811664
McAfee	Artemis!AB79F25EB651
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Variant.Ursu.811664
Cybereason	malicious.b10473
APEX	Malicious
Avast	Win32:Malware-gen
GData	Gen:Variant.Ursu.811664
Kaspersky	Trojan.Win32.Zenpak.ync
AegisLab	Riskware.Win32.Ursu.1!c
McAfee-GW-Edition	BehavesLike.Win32.BadFile.vc
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Ursu.811664 (B)
MAX	malware (ai score=88)
Arcabit	Trojan.Ursu.DC6290
ZoneAlarm	Trojan.Win32.Zenpak.ync
ALYac	Gen:Variant.Ursu.811664
Ad-Aware	Gen:Variant.Ursu.811664
AVG	Win32:Malware-gen

How to remove Ursu.811664?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Should I remove “Ursu.811664”?