Home Malware Programs Viruses Virus.Win32.Suspic.gen

Virus.Win32.Suspic.gen

Posted: August 19, 2011

Virus.Win32.Suspic.gen is a generalized and behavior-based detection for a file that's been modified by a virus. Although some Virus.Win32.Suspic.gen alerts are genuine, SpywareRemove.com malware experts have also found many Virus.Win32.Suspic.gen detections that are false positives (or safe files that have been accidentally labeled as viruses). Due to the broadly-applicable nature of Virus.Win32.Suspic.gen as a label and the occasional false alert, SpywareRemove.com malware researchers strongly recommend that you be careful to double-check any files that may contain a Virus.Win32.Suspic.gen threat. Use discerning anti-malware scanners to help determine whether or not the danger is real or illusionary, before you try to remove Virus.Win32.Suspic.gen. Signs of real Virus.Win32.Suspic.gen infections can be incredibly varied, but system freezes, browser hijacks, system slowdowns, difficulty using security software and the presence of unfamiliar programs may all indicate a Virus.Win32.Suspic.gen infection.
 

When a Real Virus.Win32.Suspic.gen is Something to Worry About

A real Virus.Win32.Suspic.gen infection can be detected by an astonishingly large number of aliases, but its most noticeable ones (those with over twenty incidents) are noted here for relevance: Suspicious file, Ramnit.D, Trojan.Gen.2, UnclassifiedMalware, Heuristic.LooksLike.Win32.SuspiciousPE.J, HEUR/Malware, Trojan.Gen, Virus.Win32.Malware!IK, Virus, Patchload.O, Rorpian, Trojan-Spy.Win32.Zbot and Trojan-Spy.Win32.Zbot!IK. The type of alias that Virus.Win32.Suspic.gen presents will vary with the type of anti-malware scanners that detects Virus.Win32.Suspic.gen, as well as by the variant of Virus.Win32.Suspic.gen that's involved.
 
Because Virus.Win32.Suspic.gen is a behavior-based or heuristic detection, Virus.Win32.Suspic.gen is capable of showing off a wide range of different attributes. Virus.Win32.Suspic.gen may be used like a spyware program (to steal passwords and other sensitive data), like a Trojan to disable your security settings or install malicious programs, like a worm to create duplicates of itself or like, of course, a virus that can infect other files. However, if you're certain that Virus.Win32.Suspic.gen is a real infection, you should always try to remove Virus.Win32.Suspic.gen with suitable anti-malware products, since actual Virus.Win32.Suspic.gen attacks are always harmful.
 

Why Virus.Win32.Suspic.gen May Not Always Be a Cause for Fright

Although a real Virus.Win32.Suspic.gen is a severe problem, false positives of Virus.Win32.Suspic.gen are also very common and aren't worrisome or dangerous. SpywareRemove.com malware research team has found that many fake Virus.Win32.Suspic.gen warnings occur due to the presence of the file 'cldemuxer.ax,' which is confirmed to be non-malicious.
 
Other false positives for Virus.Win32.Suspic.gen may also be triggered by CD-burning and emulation software, as well as by certain pseudo-legitimate programs that have no harmful functions but attempt to conceal themselves from Digital Rights Management software. You should use your judgment on whether or not you should delete a fake Virus.Win32.Suspic.gen infection, since such files are not absolutely hostile but may cause incompatibilities with other programs.
 
If you feel the need to allow a fake Virus.Win32.Suspic.gen to stick around, all you need to do is add the Virus.Win32.Suspic.gen file to an exceptions list, which is a feature on any reputable anti-malware product. In many cases, updating threat definitions for your security scanners will cause the Virus.Win32.Suspic.gen false alarm to be cured.

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:



%Temp%\271859.dll File name: %Temp%\271859.dll
File type: Dynamic link library
Mime Type: unknown/dll
%Windir%\Temp\185296.dll File name: %Windir%\Temp\185296.dll
File type: Dynamic link library
Mime Type: unknown/dll
%Windir%\Temp\arp.bat File name: %Windir%\Temp\arp.bat
File type: Batch file
Mime Type: unknown/bat
%System%\eghmi3.exe File name: %System%\eghmi3.exe
File type: Executable File
Mime Type: unknown/exe
%System%\nwcwks.dll File name: %System%\nwcwks.dll
File type: Dynamic link library
Mime Type: unknown/dll
%AppData%\5ryy.log File name: %AppData%\5ryy.log
Mime Type: unknown/log
%AppData%\LocalAccountAuthority.bat File name: %AppData%\LocalAccountAuthority.bat
File type: Batch file
Mime Type: unknown/bat
%AppData%\lssas.exe File name: %AppData%\lssas.exe
File type: Executable File
Mime Type: unknown/exe
%AppData%\manager.exe File name: %AppData%\manager.exe
File type: Executable File
Mime Type: unknown/exe
%AppData%\mlog File name: %AppData%\mlog
%AppData%\MouseDriver.bat File name: %AppData%\MouseDriver.bat
File type: Batch file
Mime Type: unknown/bat
%AppData%\Plug.bat File name: %AppData%\Plug.bat
File type: Batch file
Mime Type: unknown/bat
%AppData%\ufooz13y.exe File name: %AppData%\ufooz13y.exe
File type: Executable File
Mime Type: unknown/exe

Registry Modifications

The following newly produced Registry Values are:

HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\VRT2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\VRT2\DEBUGHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MouseDriverHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plug ManagerHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\SecurityHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Plug Manager\SecurityHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\ControlHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plug Manager\SecurityHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Local Account Authority Service\SecurityHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ExplorerHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYSHKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Loading...