Virus.Win32.Suspic.gen
Virus.Win32.Suspic.gen is a generalized and behavior-based detection for a file that's been modified by a virus. Although some Virus.Win32.Suspic.gen alerts are genuine, SpywareRemove.com malware experts have also found many Virus.Win32.Suspic.gen detections that are false positives (or safe files that have been accidentally labeled as viruses). Due to the broadly-applicable nature of Virus.Win32.Suspic.gen as a label and the occasional false alert, SpywareRemove.com malware researchers strongly recommend that you be careful to double-check any files that may contain a Virus.Win32.Suspic.gen threat. Use discerning anti-malware scanners to help determine whether or not the danger is real or illusionary, before you try to remove Virus.Win32.Suspic.gen. Signs of real Virus.Win32.Suspic.gen infections can be incredibly varied, but system freezes, browser hijacks, system slowdowns, difficulty using security software and the presence of unfamiliar programs may all indicate a Virus.Win32.Suspic.gen infection.
When a Real Virus.Win32.Suspic.gen is Something to Worry About
A real Virus.Win32.Suspic.gen infection can be detected by an astonishingly large number of aliases, but its most noticeable ones (those with over twenty incidents) are noted here for relevance: Suspicious file, Ramnit.D, Trojan.Gen.2, UnclassifiedMalware, Heuristic.LooksLike.Win32.SuspiciousPE.J, HEUR/Malware, Trojan.Gen, Virus.Win32.Malware!IK, Virus, Patchload.O, Rorpian, Trojan-Spy.Win32.Zbot and Trojan-Spy.Win32.Zbot!IK. The type of alias that Virus.Win32.Suspic.gen presents will vary with the type of anti-malware scanners that detects Virus.Win32.Suspic.gen, as well as by the variant of Virus.Win32.Suspic.gen that's involved.
Because Virus.Win32.Suspic.gen is a behavior-based or heuristic detection, Virus.Win32.Suspic.gen is capable of showing off a wide range of different attributes. Virus.Win32.Suspic.gen may be used like a spyware program (to steal passwords and other sensitive data), like a Trojan to disable your security settings or install malicious programs, like a worm to create duplicates of itself or like, of course, a virus that can infect other files. However, if you're certain that Virus.Win32.Suspic.gen is a real infection, you should always try to remove Virus.Win32.Suspic.gen with suitable anti-malware products, since actual Virus.Win32.Suspic.gen attacks are always harmful.
Why Virus.Win32.Suspic.gen May Not Always Be a Cause for Fright
Although a real Virus.Win32.Suspic.gen is a severe problem, false positives of Virus.Win32.Suspic.gen are also very common and aren't worrisome or dangerous. SpywareRemove.com malware research team has found that many fake Virus.Win32.Suspic.gen warnings occur due to the presence of the file 'cldemuxer.ax,' which is confirmed to be non-malicious.
Other false positives for Virus.Win32.Suspic.gen may also be triggered by CD-burning and emulation software, as well as by certain pseudo-legitimate programs that have no harmful functions but attempt to conceal themselves from Digital Rights Management software. You should use your judgment on whether or not you should delete a fake Virus.Win32.Suspic.gen infection, since such files are not absolutely hostile but may cause incompatibilities with other programs.
If you feel the need to allow a fake Virus.Win32.Suspic.gen to stick around, all you need to do is add the Virus.Win32.Suspic.gen file to an exceptions list, which is a feature on any reputable anti-malware product. In many cases, updating threat definitions for your security scanners will cause the Virus.Win32.Suspic.gen false alarm to be cured.
Technical Details
File System Modifications
Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.
The following files were created in the system:%Temp%\271859.dll
File name: %Temp%\271859.dllFile type: Dynamic link library
Mime Type: unknown/dll
%Windir%\Temp\185296.dll
File name: %Windir%\Temp\185296.dllFile type: Dynamic link library
Mime Type: unknown/dll
%Windir%\Temp\arp.bat
File name: %Windir%\Temp\arp.batFile type: Batch file
Mime Type: unknown/bat
%System%\eghmi3.exe
File name: %System%\eghmi3.exeFile type: Executable File
Mime Type: unknown/exe
%System%\nwcwks.dll
File name: %System%\nwcwks.dllFile type: Dynamic link library
Mime Type: unknown/dll
%AppData%\5ryy.log
File name: %AppData%\5ryy.logMime Type: unknown/log
%AppData%\LocalAccountAuthority.bat
File name: %AppData%\LocalAccountAuthority.batFile type: Batch file
Mime Type: unknown/bat
%AppData%\lssas.exe
File name: %AppData%\lssas.exeFile type: Executable File
Mime Type: unknown/exe
%AppData%\manager.exe
File name: %AppData%\manager.exeFile type: Executable File
Mime Type: unknown/exe
%AppData%\mlog
File name: %AppData%\mlog%AppData%\MouseDriver.bat
File name: %AppData%\MouseDriver.batFile type: Batch file
Mime Type: unknown/bat
%AppData%\Plug.bat
File name: %AppData%\Plug.batFile type: Batch file
Mime Type: unknown/bat
%AppData%\ufooz13y.exe
File name: %AppData%\ufooz13y.exeFile type: Executable File
Mime Type: unknown/exe
Registry Modifications
HKEY..\..\..\..{Subkeys}HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\VRT2HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ESENT\Process\VRT2\DEBUGHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MouseDriverHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plug ManagerHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\NWCWorkstation\SecurityHKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Plug Manager\SecurityHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_NWCWORKSTATION\0000\ControlHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Plug Manager\SecurityHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Local Account Authority Service\SecurityHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ExplorerHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDORSYSHKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
Leave a Reply
Please note that we are not able to assist with billing and support issues regarding SpyHunter or other products. If you're having issues with SpyHunter, please get in touch with SpyHunter customer support through your SpyHunter . If you have SpyHunter billing questions, we recommend you check the Billing FAQ. For general suggestions or feedback, contact us.