Adware.Pirrit

By JubileeX in Adware, Mac Malware

Threat Scorecard

Ranking:	8,065
Threat Level:	20 % (Normal)
Infected Computers:	128,290

First Seen:	January 23, 2014
Last Seen:	April 15, 2024
OS(es) Affected:	Windows

Adware.macOS.Pirrit, Pirrit Mac Adware, or simply Pirrit, is a piece of Adware aimed at bombarding PC users with annoying pop-ups. Having bugged Windows-based machines, Pirrit has now set eyes on macOS systems, as well. Pirrit flags as a Potentially Unwanted Program (PUP) due to the intrusive nature of the ads that come with it.

Table of Contents

A Nerve-Wracking Experience

Imagine being flooded with miscellaneous ads, banners, pop-ups, coupons, and surveys, which keep popping up while you are browsing the web. They disrupt your activity and lead you straight to a variety of suspicious websites you’ve never seen before. That’s what Pirrit does, and that’s when you should raise a red flag signifying that your Mac has come under an adware attack. Albeit a low-level threat, adware tools like Pirrit may bring you to malware-infested sites anytime. Moreover, those sites may turn out to contain much more severe pieces of malware hidden beneath the sea of pop-ups and banners generated by Pirrit itself. In the worst-case scenario, Pirrit may lead you to a Trojan capable of harvesting your banking details, login credentials, or other personal data. What is more, some victims have even complained about having had their microphones and cameras hijacked. That's why letting the Pirrit Adware reside in your Mac is a no-go.

Distribution Tactics and Operation

Adware.macOS.Pirrit typically comes as part of software bundles of popular programs users can get from the Internet. Besides the core tools, those bundles may often include lots of additional, often superfluous programs. Unless you uncheck them before installation, you will get them all, which increases the prospect of getting an adware infection like the Pirrit. Once installed, Pirrit may perform many actions such as:

Highlighting particular words during web browsing.
Placing hyperlinks within the viewed web content.
Loading pop-ups until they’ve covered your whole screen, etc.

You will easily recognize you have a Pirrit adware infection when you scroll over the embedded links. If you click on a Pirrit-generated ad, the crooks behind the Adware will earn a dime or two. That explains why they have been exploiting Pirrit to plague Windows-based machines for more than six years. Here are some of Pirrit's aliases over that time:

Adware.Win32.Tirrip.f, Generic5.AUTI [AVG], Riskware/Pirrit [Fortinet], Win32.Adware.Tirrip.Wrqs, Win32/AdWare.Pirrit.A, Trj/CI.A [Panda], AdWare.Tirrip, Win32.Troj.Tirrip.f.(kcloud), GrayWare[AdWare:not-a-virus]/Win32.Tirrip [Antiy-AVL], SPR/Tool.63488.4, AdWare/Tirrip.f, RDN/Generic PUP.x!c2y [McAfee-GW-Edition], Adware.Tirrip.Win32.6, Adware.Pirrit.2 [DrWeb] and ApplicUnwnt [Comodo].

Pirrit Removal

Like any other piece of Adware, you can either delete Pirrit manually or automatically. The latter method stands a much higher chance of cleaning up all the residual files, regardless of their destination folders. So, waste no time running a reputable AV solution to regain control of your Mac.

Aliases

15 security vendors flagged this file as malicious.

Anti-Virus Software	Detection
AVG	Generic5.AUTI
Fortinet	Riskware/Pirrit
Panda	Trj/CI.A
Antiy-AVL	GrayWare[AdWare:not-a-virus]/Win32.Tirrip
McAfee-GW-Edition	RDN/Generic PUP.x!c2y
DrWeb	Adware.Pirrit.2
Comodo	ApplicUnwnt
Sophos	Generic PUA PC
Kaspersky	not-a-virus:AdWare.Win32.Tirrip.f
Avast	Win32:PirritSuggestor-A [Adw]
Symantec	Trojan.Gen.2
K7AntiVirus	Adware ( 004a0c581 )
CAT-QuickHeal	AdWare.Tirrip.r5 (Not a Virus)
GData	Win32.Backdoor.NGService.C
Symantec	WS.Reputation.1

SpyHunter Detects & Remove Adware.Pirrit

File System Details

Adware.Pirrit may create the following file(s):

Expand All | Collapse All

#	File Name	MD5	Detections Detections: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
1.	WinSystemUpdater.exe	f84f55d365a414e52d3d0821a60855e5	155
Name: WinSystemUpdater.exe MD5: f84f55d365a414e52d3d0821a60855e5 Size: 240.64 KB (240640 bytes) Detections: 155 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
2.	WinSystemCleaner.exe	ee8bda935c173d53fa6b8da4585e88bc	139
Name: WinSystemCleaner.exe MD5: ee8bda935c173d53fa6b8da4585e88bc Size: 1.06 MB (1062912 bytes) Detections: 139 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
3.	WinSystemCleaner.exe	80485cc586df371dcc9c86c1a33cd170	75
Name: WinSystemCleaner.exe MD5: 80485cc586df371dcc9c86c1a33cd170 Size: 1.06 MB (1062912 bytes) Detections: 75 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
4.	WinSystemCleaner.exe	2843a01b05c92f7b2bb3bd56c0a3886a	51
Name: WinSystemCleaner.exe MD5: 2843a01b05c92f7b2bb3bd56c0a3886a Size: 1.06 MB (1062912 bytes) Detections: 51 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
5.	WinSystemUpdater.exe	e4fb25d368c4b69ebd24d67d1f899040	50
Name: WinSystemUpdater.exe MD5: e4fb25d368c4b69ebd24d67d1f899040 Size: 240.64 KB (240640 bytes) Detections: 50 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
6.	WinSystemCleaner.exe	b34ed12013e0dfd2df37996b077e15b1	50
Name: WinSystemCleaner.exe MD5: b34ed12013e0dfd2df37996b077e15b1 Size: 831.48 KB (831488 bytes) Detections: 50 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
7.	WinSystemCleaner.exe	9a9538431b6252400a381b3b172ef639	37
Name: WinSystemCleaner.exe MD5: 9a9538431b6252400a381b3b172ef639 Size: 831.48 KB (831488 bytes) Detections: 37 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
8.	WinSystemCleaner.exe	b9de551766ec5d6524c1d6c3966c8fb0	37
Name: WinSystemCleaner.exe MD5: b9de551766ec5d6524c1d6c3966c8fb0 Size: 1.06 MB (1062912 bytes) Detections: 37 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
9.	WinSystemCleaner.exe	e12a76cca3c59c6f2f41dca30d7fc06f	27
Name: WinSystemCleaner.exe MD5: e12a76cca3c59c6f2f41dca30d7fc06f Size: 1.06 MB (1062912 bytes) Detections: 27 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
10.	WinSystemCleaner.exe	f89ed6e2bf840b0681b43adc4fbe2109	27
Name: WinSystemCleaner.exe MD5: f89ed6e2bf840b0681b43adc4fbe2109 Size: 831.48 KB (831488 bytes) Detections: 27 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
11.	WinSystemUpdater.exe	e88dbc43777253493f24806e7aab409f	21
Name: WinSystemUpdater.exe MD5: e88dbc43777253493f24806e7aab409f Size: 240.64 KB (240640 bytes) Detections: 21 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
12.	WinSystemUpdater.exe	9cb50c1dc0734aa571b562605f5a11cb	21
Name: WinSystemUpdater.exe MD5: 9cb50c1dc0734aa571b562605f5a11cb Size: 240.64 KB (240640 bytes) Detections: 21 Type: Executable File Path: %SystemDrive%\Program Files\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
13.	WinSystemCleaner.exe	0a68e284f7db0068d6f1c60691d8ac6a	17
Name: WinSystemCleaner.exe MD5: 0a68e284f7db0068d6f1c60691d8ac6a Size: 1.06 MB (1062912 bytes) Detections: 17 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
14.	WinSystemUpdater.exe	5e1aae8a944fdf133cfc376573989b93	17
Name: WinSystemUpdater.exe MD5: 5e1aae8a944fdf133cfc376573989b93 Size: 240.64 KB (240640 bytes) Detections: 17 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
15.	WinSystemUpdater.exe	e7ffa68f4a9e8a25c33b8514021fbb37	16
Name: WinSystemUpdater.exe MD5: e7ffa68f4a9e8a25c33b8514021fbb37 Size: 240.64 KB (240640 bytes) Detections: 16 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
16.	WinSystemCleaner.exe	2f7a6667fbca9e3d6cc08c99e190d029	16
Name: WinSystemCleaner.exe MD5: 2f7a6667fbca9e3d6cc08c99e190d029 Size: 831.48 KB (831488 bytes) Detections: 16 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
17.	WinSystemUpdater.exe	968d4f1863413bc72c88892a58aa146d	16
Name: WinSystemUpdater.exe MD5: 968d4f1863413bc72c88892a58aa146d Size: 240.64 KB (240640 bytes) Detections: 16 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
18.	WinSystemUpdater.exe	163e236b2de9240d630c5f406e04c2fd	16
Name: WinSystemUpdater.exe MD5: 163e236b2de9240d630c5f406e04c2fd Size: 240.64 KB (240640 bytes) Detections: 16 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
19.	WinSystemUpdater.exe	a969ee001d1e5f85d9807cf673e11781	13
Name: WinSystemUpdater.exe MD5: a969ee001d1e5f85d9807cf673e11781 Size: 240.64 KB (240640 bytes) Detections: 13 Type: Executable File Path: %SystemDrive%\Program Files\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
20.	WinSystemCleaner.exe	5cea07af29b9b37480a26990030bf7dd	12
Name: WinSystemCleaner.exe MD5: 5cea07af29b9b37480a26990030bf7dd Size: 1.06 MB (1062912 bytes) Detections: 12 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
21.	WinSystemUpdater.exe	8d0107719204715e22affdbcaa734c93	12
Name: WinSystemUpdater.exe MD5: 8d0107719204715e22affdbcaa734c93 Size: 240.64 KB (240640 bytes) Detections: 12 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
22.	WinSystemUpdater.exe	d1f4a56bc4ee7c94a5e3e912f8143302	11
Name: WinSystemUpdater.exe MD5: d1f4a56bc4ee7c94a5e3e912f8143302 Size: 240.64 KB (240640 bytes) Detections: 11 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
23.	WinSystemCleaner.exe	da59d183903745419fae611bff855792	11
Name: WinSystemCleaner.exe MD5: da59d183903745419fae611bff855792 Size: 1.06 MB (1062912 bytes) Detections: 11 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
24.	WinSystemUpdater.exe	a0abc4e6390524e578d171ccb10bcfc0	11
Name: WinSystemUpdater.exe MD5: a0abc4e6390524e578d171ccb10bcfc0 Size: 240.64 KB (240640 bytes) Detections: 11 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
25.	WinSystemCleaner.exe	2436edf5e7fa69b03f590f178f7e3b5f	11
Name: WinSystemCleaner.exe MD5: 2436edf5e7fa69b03f590f178f7e3b5f Size: 831.48 KB (831488 bytes) Detections: 11 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
26.	WinSystemCleaner.exe	dd2219ddf44d5319d3fd0a5aafbec6df	11
Name: WinSystemCleaner.exe MD5: dd2219ddf44d5319d3fd0a5aafbec6df Size: 1.06 MB (1062912 bytes) Detections: 11 Type: Executable File Path: %SystemDrive%\Program Files\WinSystem\Cleaner Group: Malware file Last Updated: January 13, 2017
27.	WinSystemUpdater.exe	a30bea5db94bb8feb9f6b7cdfc34c99a	11
Name: WinSystemUpdater.exe MD5: a30bea5db94bb8feb9f6b7cdfc34c99a Size: 240.64 KB (240640 bytes) Detections: 11 Type: Executable File Path: %SystemDrive%\Program Files\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
28.	WinSystemUpdater.exe	93170b03f6655d0c99c9a20880c6aa29	10
Name: WinSystemUpdater.exe MD5: 93170b03f6655d0c99c9a20880c6aa29 Size: 240.64 KB (240640 bytes) Detections: 10 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017
29.	WinSystemUpdater.exe	09f8718526460a801f9756608cc33630	10
Name: WinSystemUpdater.exe MD5: 09f8718526460a801f9756608cc33630 Size: 240.64 KB (240640 bytes) Detections: 10 Type: Executable File Path: %PROGRAMFILES%\WinSystem\Updater Group: Malware file Last Updated: January 13, 2017

More files

Registry Details

Adware.Pirrit may create the following registry entry or registry entries:

CLSID

{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}

Regexp file mask

%PROGRAMFILES%\WinSystem\Cleaner\WinSystemCleaner.exe

%PROGRAMFILES%\WinSystem\Services\WinSystemServices.exe

%PROGRAMFILES%\WinSystem\Updater\WinSystemUpdater.exe

HKEY..\..\..\..{RegistryKeys}

SOFTWARE\Classes\Pirrit.PirritHelper

Software\Microsoft\Internet Explorer\Approved Extensions\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}

SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d40c654d-7c51-4eb3-95b2-1e23905c2a2d}

Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}

Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D40C654D-7C51-4EB3-95B2-1E23905C2A2D}

Software\Pirrit

SOFTWARE\Pirrit Solutions

SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d40c654d-7c51-4eb3-95b2-1e23905c2a2d}

SOFTWARE\Wow6432Node\Pirrit

SOFTWARE\Wow6432Node\Pirrit Solutions

SYSTEM\ControlSet001\services\PirritDesktop

SYSTEM\ControlSet001\services\PirritUpdater

SYSTEM\CurrentControlSet\services\PirritDesktop

SYSTEM\CurrentControlSet\services\PirritUpdater

Directories

Adware.Pirrit may create the following directory or directories:

%AppData%\Pirrit

%LOCALAPPDATA%\Pirrit Suggestor

%LOCALAPPDATA%\PirritSuggestor

%PROGRAMFILES%\Pirrit

%PROGRAMFILES%\Windows Network Accelerater

%PROGRAMFILES(x86)%\Pirrit

%PROGRAMFILES(x86)%\Windows Network Accelerater

%USERPROFILE%\Local Settings\Application Data\PirritSuggestor

Enigma Software Group Prevails Over Malwarebytes at the Ninth Circuit

Search

Change Region

Adware.Pirrit

Threat Scorecard

EnigmaSoft Threat Scorecard

A Nerve-Wracking Experience

Distribution Tactics and Operation

Pirrit Removal

Aliases

SpyHunter Detects & Remove Adware.Pirrit

File System Details

Registry Details

Directories

Submit Comment

Trending

CVE-2024-3094 Vulnerability (XZ Backdoor)

Hupdex Crypto Scam

Check-tl-ver-12-7.top

Most Viewed

Discord Shows Black Screen when Sharing Screen

How To Fix 'Printer Driver is Unavailable' Error

What is Msedge.exe?