How to remove "Ursu.913859"?

The Ursu.913859 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Ursu.913859 virus can do?

Executable code extraction
Attempts to connect to a dead IP:Port (4 unique times)
Creates RWX memory
HTTP traffic contains suspicious features which may be indicative of malware related traffic
Performs some HTTP requests
Unconventionial language used in binary resources: Latvian
The binary likely contains encrypted or compressed data.
Collects information to fingerprint the system
Anomalous binary characteristics

Related domains:

telete.in

apps.identrust.com

How to determine Ursu.913859?


File Info:
crc32: 85D7B126
md5: d007b7b2a39807333ee6926c51e11a77
name: tmp0b2jj0vq
sha1: ab7d370754d2b3702d59f23c542ffbbae345f43e
sha256: ba2da4c0159c376f97c1442f2b1c8a8c813c32b58602f3f191cee17604e5944f
sha512: 3445a40ab89a1a2a28e98534854145d06c2249213cc7597dc53eb051fb5be374dc25f39cdc29cb71f1f4d66065a094ad2efae871930675cbef8f2eb827563732
ssdeep: 12288:SRmQ5Pa/lvZZNZ3/Q9IUlDEgs/G+GDbA3co1nZbozKiPCYRJJ:5Q5y/1NZvzsb1ZDuc+ZjYRz
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
InternalName: oczmxpwvesv.ixe
FileVersionOld: 1.2.0.1
ProductVersion: 1.0.4.1
Copyrighd: Copyrighd (C) 2020, odfgbiv
Translation: 0x0842 0x04c4

Ursu.913859 also known as:

Bkav	HW32.Packed.
MicroWorld-eScan	Gen:Variant.Ursu.913859
FireEye	Generic.mg.d007b7b2a3980733
Qihoo-360	HEUR/QVM10.1.FE87.Malware.Gen
McAfee	Artemis!D007B7B2A398
Malwarebytes	Trojan.MalPack.GS
AegisLab	Trojan.Win32.Malicious.4!c
Sangfor	Malware
BitDefender	Gen:Variant.Ursu.913859
K7GW	Hacktool ( 700007861 )
Cybereason	malicious.754d2b
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HEEN
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:DangerousObject.Multi.Generic
Ad-Aware	Gen:Variant.Ursu.913859
Emsisoft	Gen:Variant.Ursu.913859 (B)
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.AdwareFileTour.hc
Fortinet	W32/Kryptik.HEDU!tr
Sophos	Mal/GandCrab-G
Endgame	malicious (high confidence)
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Wacatac.D!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Danabot.C4131083
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34128.HC0@aa0hwGpc
Cylance	Unsafe
Rising	Trojan.Kryptik!8.8 (TFE:dGZlOgXIsH/Y06Iqaw)
SentinelOne	DFI – Malicious PE
GData	Win32.Trojan-Stealer.Raccoon.68GLWZ
CrowdStrike	win/malicious_confidence_90% (W)

How to remove Ursu.913859?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

How to remove “Ursu.913859”?