Ursu.872999 removal guide

The Ursu.872999 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.872999 virus can do?

Installs itself for autorun at Windows startup
Exhibits possible ransomware file modification behavior
Writes a potential ransom message to disk
Network activity detected but not expressed in API logs
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Ursu.872999?


File Info:
crc32: 5212C07B
md5: 29ec634f7a85ff39719410695d115776
name: 29EC634F7A85FF39719410695D115776.mlw
sha1: c3ef72b5864197636baa9e7220010d270c92acfa
sha256: 136c4570a60516190907c39a14a0c67de972a9f850a2cab1c82d588673f676d1
sha512: 87416ba9e6998864fb509a8f6f1298188976ff3553078a953389a02c7325681627f3c7ae0a0511d29c60825b7170ec64317289281913ee5e8284609e3c1971da
ssdeep: 1536:J3TrnmdtTcNPdqgs6KB/QD5bwNlZ3za3lBpicOwAmStv:JP5NPdIRQDSPZCpXS
type: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows

Version Info:
LegalCopyright: (C) Software Corp.
InternalName: setup
FileVersion: 1,0,0,0
CompanyName: Software Corp.
LegalTrademarks: (C) Software Corp.
ProductName: Installer
ProductVersion: 1,0,0,0
FileDescription: Installer
OriginalFilename: setup.exe
Translation: 0x0409 0x04e4

Ursu.872999 also known as:

K7AntiVirus	Trojan ( 0055e3ef1 )
Lionic	Trojan.Win32.Generic.4!c
DrWeb	Trojan.Encoder.4306
Cynet	Malicious (score: 99)
ALYac	Gen:Variant.Ursu.872999
Cylance	Unsafe
Zillya	Trojan.GenericKD.Win32.4151
K7GW	Trojan ( 0055e3ef1 )
Cybereason	malicious.f7a85f
Cyren	W32/Ransom.CB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Filecoder.EZ
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Ursu.872999
NANO-Antivirus	Trojan.Win32.Encoder.ebqznl
MicroWorld-eScan	Gen:Variant.Ursu.872999
Tencent	Malware.Win32.Gencirc.10c22fd0
Ad-Aware	Gen:Variant.Ursu.872999
Sophos	Mal/Generic-S
F-Secure	Heuristic.HEUR/AGEN.1131979
BitDefenderTheta	Gen:NN.ZexaF.34110.fG0@aeGArZei
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	Ransom_CRYPRAAS.SMA1
McAfee-GW-Edition	GenericR-IXK!29EC634F7A85
FireEye	Generic.mg.29ec634f7a85ff39
Emsisoft	Gen:Variant.Ursu.872999 (B)
Jiangmin	Trojan.Generic.aajwg
Webroot	W32.Malware.Gen
Avira	HEUR/AGEN.1131979
eGambit	Unsafe.AI_Score_94%
Microsoft	Ransom:Win32/Sarento
SUPERAntiSpyware	Ransom.FileCryptor/Variant
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Ursu.872999
AhnLab-V3	Trojan/Win32.Ransom.C1947452
McAfee	GenericR-IXK!29EC634F7A85
MAX	malware (ai score=80)
VBA32	Trojan.Encoder
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom_CRYPRAAS.SMA1
Yandex	Trojan.GenAsa!w/gVp2pkYjo
Ikarus	Trojan-Ransom.Enigma
Fortinet	W32/Generic!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Ursu.872999?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.