Adware.Pirrit

By JubileeX in Adware, Mac Malware

Threat Scorecard

Ranking:	9,589
Threat Level:	20 % (Normal)
Infected Computers:	128,314

First Seen:	January 23, 2014
Last Seen:	January 11, 2025
OS(es) Affected:	Windows

Adware.macOS.Pirrit, Pirrit Mac Adware, or simply Pirrit, is a piece of Adware aimed at bombarding PC users with annoying pop-ups. Having bugged Windows-based machines, Pirrit has now set eyes on macOS systems, as well. Pirrit flags as a Potentially Unwanted Program (PUP) due to the intrusive nature of the ads that come with it.

Table of Contents

A Nerve-Wracking Experience

Imagine being flooded with miscellaneous ads, banners, pop-ups, coupons, and surveys, which keep popping up while you are browsing the web. They disrupt your activity and lead you straight to a variety of suspicious websites you’ve never seen before. That’s what Pirrit does, and that’s when you should raise a red flag signifying that your Mac has come under an adware attack. Albeit a low-level threat, adware tools like Pirrit may bring you to malware-infested sites anytime. Moreover, those sites may turn out to contain much more severe pieces of malware hidden beneath the sea of pop-ups and banners generated by Pirrit itself. In the worst-case scenario, Pirrit may lead you to a Trojan capable of harvesting your banking details, login credentials, or other personal data. What is more, some victims have even complained about having had their microphones and cameras hijacked. That's why letting the Pirrit Adware reside in your Mac is a no-go.

Distribution Tactics and Operation

Adware.macOS.Pirrit typically comes as part of software bundles of popular programs users can get from the Internet. Besides the core tools, those bundles may often include lots of additional, often superfluous programs. Unless you uncheck them before installation, you will get them all, which increases the prospect of getting an adware infection like the Pirrit. Once installed, Pirrit may perform many actions such as:

Highlighting particular words during web browsing.
Placing hyperlinks within the viewed web content.
Loading pop-ups until they’ve covered your whole screen, etc.

You will easily recognize you have a Pirrit adware infection when you scroll over the embedded links. If you click on a Pirrit-generated ad, the crooks behind the Adware will earn a dime or two. That explains why they have been exploiting Pirrit to plague Windows-based machines for more than six years. Here are some of Pirrit's aliases over that time:

Adware.Win32.Tirrip.f, Generic5.AUTI [AVG], Riskware/Pirrit [Fortinet], Win32.Adware.Tirrip.Wrqs, Win32/AdWare.Pirrit.A, Trj/CI.A [Panda], AdWare.Tirrip, Win32.Troj.Tirrip.f.(kcloud), GrayWare[AdWare:not-a-virus]/Win32.Tirrip [Antiy-AVL], SPR/Tool.63488.4, AdWare/Tirrip.f, RDN/Generic PUP.x!c2y [McAfee-GW-Edition], Adware.Tirrip.Win32.6, Adware.Pirrit.2 [DrWeb] and ApplicUnwnt [Comodo].

Pirrit Removal

Like any other piece of Adware, you can either delete Pirrit manually or automatically. The latter method stands a much higher chance of cleaning up all the residual files, regardless of their destination folders. So, waste no time running a reputable AV solution to regain control of your Mac.

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software	Detection
AVG	Generic5.AUTI
Fortinet	Riskware/Pirrit
Panda	Trj/CI.A
Antiy-AVL	GrayWare[AdWare:not-a-virus]/Win32.Tirrip
McAfee-GW-Edition	RDN/Generic PUP.x!c2y
DrWeb	Adware.Pirrit.2
Comodo	ApplicUnwnt
Sophos	Generic PUA PC
Kaspersky	not-a-virus:AdWare.Win32.Tirrip.f
Avast	Win32:PirritSuggestor-A [Adw]
Symantec	Trojan.Gen.2
K7AntiVirus	Adware ( 004a0c581 )
CAT-QuickHeal	AdWare.Tirrip.r5 (Not a Virus)
GData	Win32.Backdoor.NGService.C
Symantec	WS.Reputation.1

SpyHunter Detects & Remove Adware.Pirrit

File System Details

Adware.Pirrit may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	wauctla.exe	7d1e5892bb021fa20a03b7cd932a72da	3,798
Name: wauctla.exe MD5: 7d1e5892bb021fa20a03b7cd932a72da Size: 1.04 MB (1044480 bytes) Detections: 3,798 Type: Executable File Path: C:\Windows\wauctla.exe Group: Malware file Last Updated: May 25, 2022
2.	winvxm.exe	b34a08ba3041ae88e1953d22bec7ae38	2,477
Name: winvxm.exe MD5: b34a08ba3041ae88e1953d22bec7ae38 Size: 2.97 MB (2976880 bytes) Detections: 2,477 Type: Executable File Path: C:\Program Files (x86)\Windows Network Accelerater\v5\winvxm.exe Group: Malware file Last Updated: October 14, 2021
3.	openmemdiag_64.exe	726790ac4efe16ff25705c76c299d02b	213
Name: openmemdiag_64.exe MD5: 726790ac4efe16ff25705c76c299d02b Size: 83.45 KB (83456 bytes) Detections: 213 Type: Executable File Path: C:\Windows\system32\openmemdiag_64\openmemdiag_64.exe Group: Malware file Last Updated: January 1, 2024
4.	FileImportProgram.exe	9e9b754b9ca5081a4eca625567e1262d	191
Name: FileImportProgram.exe MD5: 9e9b754b9ca5081a4eca625567e1262d Size: 98.34 KB (98341 bytes) Detections: 191 Type: Executable File Path: %SystemDrive%\Users\<username>\AppData\Local\FileImportProgram Group: Malware file Last Updated: September 24, 2016
5.	GUIRootSoftware.exe	152531bfef6e09defb06c29b0c6b0235	191
Name: GUIRootSoftware.exe MD5: 152531bfef6e09defb06c29b0c6b0235 Size: 98.34 KB (98341 bytes) Detections: 191 Type: Executable File Path: %LOCALAPPDATA%\GUIRootSoftware Group: Malware file Last Updated: September 24, 2016
6.	vxmclient.exe	3f6ddb4b5a066321544176c599b53a70	159
Name: vxmclient.exe MD5: 3f6ddb4b5a066321544176c599b53a70 Size: 4.58 MB (4586400 bytes) Detections: 159 Type: Executable File Path: C:\Program Files (x86)\Windows Network Accelerater\v3\vxmclient.exe Group: Malware file Last Updated: March 12, 2022
7.	DriverFreewareOS.exe	6af6c4cdf188f4e31a4d0f23224c4b79	138
Name: DriverFreewareOS.exe MD5: 6af6c4cdf188f4e31a4d0f23224c4b79 Size: 98.34 KB (98341 bytes) Detections: 138 Type: Executable File Path: %USERPROFILE%\Local Settings\Application Data\DriverFreewareOS Group: Malware file Last Updated: September 24, 2016
8.	ExportFunctionGamma.exe	72d0641e3b4f1e6523f58ca948f0771e	84
Name: ExportFunctionGamma.exe MD5: 72d0641e3b4f1e6523f58ca948f0771e Size: 98.34 KB (98341 bytes) Detections: 84 Type: Executable File Path: %LOCALAPPDATA%\ExportFunctionGamma Group: Malware file Last Updated: September 24, 2016
9.	CronDirect3dWinsock.exe	45d02e3c3e7c34539980b2cfdc0e739f	82
Name: CronDirect3dWinsock.exe MD5: 45d02e3c3e7c34539980b2cfdc0e739f Size: 98.34 KB (98341 bytes) Detections: 82 Type: Executable File Path: %LOCALAPPDATA%\CronDirect3dWinsock Group: Malware file Last Updated: September 24, 2016
10.	ExportInterpreterODBC.exe	c5a19d1aba6f3fa39d9c8b229ffef6b3	76
Name: ExportInterpreterODBC.exe MD5: c5a19d1aba6f3fa39d9c8b229ffef6b3 Size: 98.34 KB (98341 bytes) Detections: 76 Type: Executable File Path: %LOCALAPPDATA%\ExportInterpreterODBC Group: Malware file Last Updated: September 24, 2016
11.	CompileMinimalSnapshot.exe	9db5393724c9795221e46bc262c6f765	73
Name: CompileMinimalSnapshot.exe MD5: 9db5393724c9795221e46bc262c6f765 Size: 98.34 KB (98341 bytes) Detections: 73 Type: Executable File Path: %SystemDrive%\Users\<username>\AppData\Local\CompileMinimalSnapshot Group: Malware file Last Updated: September 24, 2016
12.	DashboardMacroMotion.exe	cb54914a0ec158e62d341ef14f20111c	73
Name: DashboardMacroMotion.exe MD5: cb54914a0ec158e62d341ef14f20111c Size: 98.34 KB (98341 bytes) Detections: 73 Type: Executable File Path: %SystemDrive%\Users\<username>\AppData\Local\DashboardMacroMotion Group: Malware file Last Updated: September 24, 2016
13.	DefaultGammaTooltip.exe	b64eb5d608203fb2fec787b7451ad7e2	73
Name: DefaultGammaTooltip.exe MD5: b64eb5d608203fb2fec787b7451ad7e2 Size: 98.34 KB (98341 bytes) Detections: 73 Type: Executable File Path: %LOCALAPPDATA%\DefaultGammaTooltip Group: Malware file Last Updated: September 24, 2016
14.	AppOfficeRegister.exe	67b3efe0675d8787bced4027e43325f2	72
Name: AppOfficeRegister.exe MD5: 67b3efe0675d8787bced4027e43325f2 Size: 98.34 KB (98341 bytes) Detections: 72 Type: Executable File Path: %SystemDrive%\Users\<username>\AppData\Local\AppOfficeRegister Group: Malware file Last Updated: September 24, 2016
15.	FinderGUIOCR.exe	1bc29840497317001b6e2b46b8013dda	72
Name: FinderGUIOCR.exe MD5: 1bc29840497317001b6e2b46b8013dda Size: 98.34 KB (98341 bytes) Detections: 72 Type: Executable File Path: %LOCALAPPDATA%\FinderGUIOCR Group: Malware file Last Updated: September 24, 2016
16.	Direct3dProcessSnapshot.exe	b32e9d254583d8050bf7621e09a9f4ba	70
Name: Direct3dProcessSnapshot.exe MD5: b32e9d254583d8050bf7621e09a9f4ba Size: 98.34 KB (98341 bytes) Detections: 70 Type: Executable File Path: %USERPROFILE%\Local Settings\Application Data\Direct3dProcessSnapshot Group: Malware file Last Updated: September 24, 2016
17.	JAVAOpenScreenshot.exe	c2c8c46de2752cd14c1485b51c18e079	70
Name: JAVAOpenScreenshot.exe MD5: c2c8c46de2752cd14c1485b51c18e079 Size: 98.34 KB (98341 bytes) Detections: 70 Type: Executable File Path: %USERPROFILE%\Local Settings\Application Data\JAVAOpenScreenshot Group: Malware file Last Updated: September 24, 2016
18.	WinSystemCleaner.exe	2843a01b05c92f7b2bb3bd56c0a3886a	51
Name: WinSystemCleaner.exe MD5: 2843a01b05c92f7b2bb3bd56c0a3886a Size: 1.06 MB (1062912 bytes) Detections: 51 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
19.	DebuggerOCRSDK.exe	fabcb1eb1b0f2a204029837753694955	31
Name: DebuggerOCRSDK.exe MD5: fabcb1eb1b0f2a204029837753694955 Size: 69.12 KB (69120 bytes) Detections: 31 Type: Executable File Path: %WINDIR%\SysWOW64\DebuggerOCRSDK Group: Malware file Last Updated: May 19, 2020
20.	chrome32.exe	f53f8293448cc33a75b96f36e3c19705	20
Name: chrome32.exe MD5: f53f8293448cc33a75b96f36e3c19705 Size: 188.41 KB (188416 bytes) Detections: 20 Type: Executable File Path: C:\Users\<username>\AppData\Local\Helper\chrome32.exe Group: Malware file Last Updated: May 29, 2023
21.	chrome64.exe	75407b350565593eb52d3f58b4d04584	18
Name: chrome64.exe MD5: 75407b350565593eb52d3f58b4d04584 Size: 243.71 KB (243712 bytes) Detections: 18 Type: Executable File Path: C:\Users\<username>\AppData\Local\Helper\chrome64.exe Group: Malware file Last Updated: May 29, 2023
22.	CopyMotionScreenshot.exe	84c299db01efbd675ceecfe10b148c9a	16
Name: CopyMotionScreenshot.exe MD5: 84c299db01efbd675ceecfe10b148c9a Size: 158.72 KB (158720 bytes) Detections: 16 Type: Executable File Path: C:\Windows.old.000\Users\<username>\AppData\Local\CopyMotionScreenshot\CopyMotionScreenshot.exe Group: Malware file Last Updated: January 15, 2025
23.	WinSystemUpdater.exe	8d0107719204715e22affdbcaa734c93	12
Name: WinSystemUpdater.exe MD5: 8d0107719204715e22affdbcaa734c93 Size: 240.64 KB (240640 bytes) Detections: 12 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
24.	mswsocktspkgProvider.exe	b313522f02b459116dd6ec13f24712dd	5
Name: mswsocktspkgProvider.exe MD5: b313522f02b459116dd6ec13f24712dd Size: 209.4 KB (209408 bytes) Detections: 5 Type: Executable File Path: %LOCALAPPDATA%\mswsocktspkgProvider Group: Malware file Last Updated: January 27, 2015
25.	sharewaresdiagschdProt.exe	16d2a7efcec5a4d3f63f3865aa79e150	2
Name: sharewaresdiagschdProt.exe MD5: 16d2a7efcec5a4d3f63f3865aa79e150 Size: 209.4 KB (209408 bytes) Detections: 2 Type: Executable File Path: %LOCALAPPDATA%\sharewaresdiagschdProt Group: Malware file Last Updated: January 27, 2015
26.	RegFltrX86.sys	1ebeaed0c88721366ba7d99939042833	1
Name: RegFltrX86.sys MD5: 1ebeaed0c88721366ba7d99939042833 Size: 17.55 KB (17552 bytes) Detections: 1 Type: System file Path: \??\C:\Users\<username>\AppData\Local\AppRawScript Group: Malware file Last Updated: March 26, 2016

More files

Registry Details

Adware.Pirrit may create the following registry entry or registry entries:

CLSID

{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}

Regexp file mask

%PROGRAMFILES%\WinSystem\Cleaner\WinSystemCleaner.exe

%PROGRAMFILES%\WinSystem\Services\WinSystemServices.exe

%PROGRAMFILES%\WinSystem\Updater\WinSystemUpdater.exe

HKEY..\..\..\..{RegistryKeys}

SOFTWARE\Classes\Pirrit.PirritHelper

Software\Microsoft\Internet Explorer\Approved Extensions\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}

SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d40c654d-7c51-4eb3-95b2-1e23905c2a2d}

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}

Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}

Software\Pirrit

SOFTWARE\Pirrit Solutions

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d40c654d-7c51-4eb3-95b2-1e23905c2a2d}

SOFTWARE\Wow6432Node\Pirrit

SOFTWARE\Wow6432Node\Pirrit Solutions

SYSTEM\ControlSet001\services\PirritDesktop

SYSTEM\ControlSet001\services\PirritUpdater

SYSTEM\CurrentControlSet\services\PirritDesktop

SYSTEM\CurrentControlSet\services\PirritUpdater

Directories

Adware.Pirrit may create the following directory or directories:

%AppData%\Pirrit

%LOCALAPPDATA%\Pirrit Suggestor

%LOCALAPPDATA%\PirritSuggestor

%PROGRAMFILES%\Pirrit

%PROGRAMFILES%\Windows Network Accelerater

%PROGRAMFILES(x86)%\Pirrit

%PROGRAMFILES(x86)%\Windows Network Accelerater

%USERPROFILE%\Local Settings\Application Data\PirritSuggestor

EnigmaSoft's SpyHunter for Windows Has Achieved AV-TEST Certification

Search

Change Region

Adware.Pirrit

Threat Scorecard

EnigmaSoft Threat Scorecard

A Nerve-Wracking Experience

Distribution Tactics and Operation

Pirrit Removal

Aliases

SpyHunter Detects & Remove Adware.Pirrit

File System Details

Registry Details

Directories

Submit Comment

Trending

Eu.rpdatabox.xyz

Sqout Bing Search Redirects Virus

Butsmism.co.in

Most Viewed

Discord Is Stuck on Gray Screen

Discord Shows Black Screen when Sharing Screen

How To Fix 'Printer Driver is Unavailable' Error