How to remove “Ursu.949587”?

The Ursu.949587 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Ursu.949587 virus can do?

Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary likely contains encrypted or compressed data.
Anomalous binary characteristics

How to determine Ursu.949587?


File Info:
crc32: 6A5AADDC
md5: 05f190f34ab784691e2478667ca2ba4a
name: 05F190F34AB784691E2478667CA2BA4A.mlw
sha1: c360511ada0b70f894d67d7619ac874f3bd30b39
sha256: 5fe8f681d5b55913758a9368b3541bcb1d63e8e78417c503f689d49851135ce7
sha512: 41326d026c9495316d55cf24ced7b3c1908e3d010cff4b8ea5ec85eefd9540e4528a306731127a972c9ace6a562988f3acacb2645cef606b8bb2c586c1262a76
ssdeep: 6144:0yF3xUe/RI6uK9iaYelqP/lpw12mnonLO6nvDO4pF0CEwfuElOttI1sVJ2X:0y1xU0I6uunCgSny6rd0ChTYttI+
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: 
InternalName: QQ9810736
FileVersion: 8.12.0.0
CompanyName: x5929x5b87x79d1x6280
LegalTrademarks: 
Comments: 
ProductName: 
ProductVersion: 1.0.0.0
FileDescription: CHx6295x7968x8f6fx4ef6
OriginalFilename: 
Translation: 0x0804 0x03a8

Ursu.949587 also known as:

K7AntiVirus	Trojan ( 7000000f1 )
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.Generic.S525138
ALYac	Gen:Variant.Ursu.949587
Cylance	Unsafe
Alibaba	RiskWare:Win32/HangVote.177367fb
K7GW	Trojan ( 7000000f1 )
Cybereason	malicious.34ab78
Cyren	W32/S-41bae044!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/RiskWare.HangVote.J
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Gen:Variant.Ursu.949587
MicroWorld-eScan	Gen:Variant.Ursu.949587
Ad-Aware	Gen:Variant.Ursu.949587
Sophos	Generic PUA MD (PUA)
BitDefenderTheta	Gen:NN.ZexaF.34266.AO0baywqqygb
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.gc
FireEye	Gen:Variant.Ursu.949587
Emsisoft	Gen:Variant.Ursu.949587 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1109876
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.2696AFD
Kingsoft	Win32.Troj.Generic_a.a.(kcloud)
Microsoft	Trojan:Win32/Wacatac.A!ml
GData	Gen:Variant.Ursu.949587
AhnLab-V3	Malware/Win32.RL_Generic.R304706
McAfee	Artemis!05F190F34AB7
MAX	malware (ai score=98)
VBA32	BScope.Backdoor.Attack
Malwarebytes	Malware.AI.2387482594
Panda	Trj/Genetic.gen
Rising	Malware.Heuristic!ET#100% (RDMK:cmRtazorAL7OdX3nZESsZiLXI6LF)
Yandex	Trojan.GenAsa!ZFxQXQp5ezA
Ikarus	Backdoor.Win32.Hupigon
Fortinet	W32/GenericRXDZ.UV!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Ursu.949587?

Ursu.949587 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X