Should I remove “Ursu.839641”?

The Ursu.839641 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.839641 virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• At least one IP Address, Domain, or File Name was found in a crypto call
• CAPE extracted potentially suspicious content
• Authenticode signature is invalid
• Attempts to stop active services
• A process attempted to delay the analysis task by a long amount of time.
• Anomalous binary characteristics

How to determine Ursu.839641?

File Info:
name: B940A415C539238C106B.mlw
path: /opt/CAPEv2/storage/binaries/b9b7cf4be67aeba29039fef5c49d7d53bae82b89a4557d7f8922910211b4312c
crc32: BBBF0B87
md5: b940a415c539238c106b42d8409c42b4
sha1: 9bc0c314177c6943f095ea9eb499f2732cff1338
sha256: b9b7cf4be67aeba29039fef5c49d7d53bae82b89a4557d7f8922910211b4312c
sha512: 8515aed187862fd990c2e832d8c1fe8e27469c5c2ff032b9ce91d76ad3ae823ec15d989aa615a1ff45c847b06ab9e57621b06be9154a587034a8fc4f852cd62f
ssdeep: 49152:vELQu9zPqeArGi35DMnCIjtAy0mUi6AjW/MUSdGRf3/Fc9IW1dXgfC/MHmg:va555DjxAZFc9IW1dXgfC/MHmg
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T12CE508C176D3867BC9A61130996095283174BFD18527BE06F25C3E9EF7BEA40A91F332
sha3_384: 666398cfac463f00cb718aec61eab371a599b398095e628847f134b82b2018df75f70956cec32f60e18105bfea7fd782
ep_bytes: ff25dce243008b5424088d420c8b4ae8
timestamp: 2007-10-11 15:56:28

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows CardSpace
FileVersion: 3.0.4506.648 (Winfxred.004506-0648)
InternalName: infocard.exe
LegalCopyright: © Microsoft Corporation.  All rights reserved.
OriginalFilename: infocard.exe
ProductName: Microsoft® .NET Framework
ProductVersion: 3.0.4506.648
Comments: Flavor=Retail
PrivateBuild: VSBLD776
Translation: 0x0409 0x04b0

Ursu.839641 also known as:

How to remove Ursu.839641?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.