Trojan.Spy.Ursnif.gen!M
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 947 |
| First Seen: | April 17, 2013 |
| Last Seen: | December 19, 2025 |
| OS(es) Affected: | Windows |
The detection of Trojan.Spy.Ursnif.gen!M indicates that your system has been compromised by a type of malicious software designed to spy on and steal sensitive information from your computer. This threat is categorized as spyware, which is a type of malware that secretly monitors and collects user data without their consent. The presence of Trojan.Spy.Ursnif.gen!M on your system poses a significant risk to your privacy and security, as it can lead to identity theft, financial loss, and unauthorized access to your personal data.
Table of Contents
What Is Trojan.Spy.Ursnif.gen!M?
Trojan.Spy.Ursnif.gen!M is a detection name that refers to a specific type of spyware that has been identified by security software. The name itself does not provide detailed information about the malware's origin, behavior, or impact, but it indicates that the malware is part of a broader category of threats known as Trojans, which are malicious programs that disguise themselves as legitimate software. Spyware like Trojan.Spy.Ursnif.gen!M is designed to remain hidden on a compromised system, making it difficult for users to detect and remove without the aid of specialized security tools.
How Trojan.Spy.Ursnif.gen!M Operates
Once Trojan.Spy.Ursnif.gen!M infects a system, it can operate in various ways to achieve its goals. It may monitor and log keystrokes, capture screenshots, steal login credentials, and intercept network traffic to gather sensitive information such as passwords, credit card numbers, and personal identifiable information. This malware can also create backdoors, allowing remote access to the compromised system, which can lead to further malicious activities such as data theft, ransomware attacks, or the distribution of additional malware.
Symptoms of Infection
Systems infected with Trojan.Spy.Ursnif.gen!M may exhibit a range of symptoms, although some infections may remain asymptomatic until significant damage has been done. Common indicators of spyware infection include unexpected system crashes, slow performance, unusual network activity, and the appearance of unwanted programs or toolbars. Users may also notice that their personal data is being used in unauthorized ways, such as seeing unfamiliar transactions on their bank statements or receiving emails that suggest their email account has been compromised.
How to Remove Trojan.Spy.Ursnif.gen!M
- Boot your computer in Safe Mode with Networking to prevent the malware from loading and to allow for internet access to download removal tools.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove all traces of Trojan.Spy.Ursnif.gen!M and any other malware that may be present.
- Uninstall any suspicious programs that were installed around the time of the infection. Be cautious and only remove programs that you are certain are malicious or unnecessary.
- Reset your web browsers (Google Chrome, Mozilla Firefox, Microsoft Edge) to their default settings to remove any malicious extensions or settings that the spyware may have altered.
- Reboot your computer and run another full scan with your anti-malware tool to ensure that all malware has been successfully removed and that your system is clean.
Conclusion
The removal of Trojan.Spy.Ursnif.gen!M requires careful and thorough action to ensure that all components of the malware are eliminated from the system. After removal, it's essential to take preventive measures to protect against future infections, including keeping your operating system and software up to date, using strong and unique passwords, avoiding suspicious downloads and email attachments, and regularly scanning your system for malware. By understanding the risks associated with spyware and taking proactive steps to secure your system, you can significantly reduce the likelihood of falling victim to malware like Trojan.Spy.Ursnif.gen!M in the future.
Aliases
15 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| AVG | Dropper.Generic8.WKA |
| Ikarus | Trojan-PWS.Win32.Zbot |
| McAfee-GW-Edition | Heuristic.LooksLike.Win32.Suspicious.C!81 |
| Sophos | Troj/Zbot-EPN |
| McAfee | Artemis!E86D4219C965 |
| McAfee-GW-Edition | Heuristic.LooksLike.Win32.Suspicious.N |
| McAfee | Artemis!831B77B37510 |
| AVG | Suspicion: unknown virus |
| Ikarus | Worm.Win32.VBNA |
| Kaspersky | Trojan.Win32.Agent.xjth |
| F-Prot | W32/VB-Wird-based!Maximus |
| Ikarus | Virus.Win32.Heur |
| Kaspersky | Trojan-Dropper.Win32.Clons.xvg |
| McAfee | Artemis!C5D3F6ECF6CB |
| Kaspersky | Trojan-Dropper.Win32.VB.celu |
SpyHunter Detects & Remove Trojan.Spy.Ursnif.gen!M
File System Details
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | n. | cd9a183e162d1cf5940fc1ddde34b66e | 20 |
| 2. | IEXPLORER.EXE | 52cad126f22f58d6406824b372b45985 | 10 |
| 3. | WindowsLiveUpdate.exe | de51dd27048033c0a3b494c8a8218015 | 10 |
| 4. | WIND75B.exe | 74941bb93ed4fb90f3c4c8371235cb37 | 5 |
| 5. | lollipop_04121305.exe | fb234b2d700d7514256bda23cebcdeee | 5 |
| 6. | libreoffice.exe | 3f272c9b675d4c8f2899b8e428fb53c9 | 4 |
| 7. | eujjmcze.dll | 388b21904cd77f680762936462c93296 | 3 |
| 8. | BF1B.exe | 1e512db447baf8d6c473f1bf8299c1fc | 3 |
| 9. | WIN46.exe | 3db64454a9c1e5e458ed693c04daad35 | 2 |
| 10. | lollipop_04101543.exe | c1c65be20b57b7080851b9fd966098e8 | 2 |
| 11. | diskhare.exe | 0ded9f21b9878092048bbf6161914b42 | 2 |
| 12. | bitzipper2.exe | 1b7f04d4ef9062f73794f70e0feeb6a7 | 2 |
| 13. | lollipop_04121712.exe | c783bad8907f4fa331683987e3e8c9fc | 2 |
| 14. | lollipop_04132226.exe | f7b90948435b3c1a878274247ae503da | 2 |
| 15. | System.exe | b82b2e7381516e3205f0955171bec8ae | 2 |
| 16. | 8476709.exe | 162b62eaeafdda5c6632fe8d943dd985 | 2 |
| 17. | cavdjgaa.exe | 4f79c51927599f75b1257e4e6696d669 | 2 |
| 18. | 00b06067.exe | 42068b5b08553164fefd1481824320bc | 2 |
| 19. | tvejjevt.exe | a47db361c48a2c5df85769a8b1ed81d3 | 2 |
| 20. | 4.exe | d34c1a698dc17d72f251a8694ba7d92e | 1 |
| 21. | Lld6t51i.exe | 6e512dbe26061acab9b7860cd8696b9e | 1 |
| 22. | mqdaylns.dll | f32b6dfe252f34737c78dd5b85711e1d | 1 |
| 23. | Lollipop.exe | bffc70e77e3433cb559d674424b596b8 | 1 |
| 24. | regeetup.exe | f89d30323aa64a81eeca7df4959bb822 | 1 |
| 25. | 5712406.exe | c591da28c79e71a0d0d5d697940a0997 | 1 |
| 26. | qbpdrg | ef7b234591766b3f0fb69f7199390365 | 1 |
| 27. | lollipop_04162355.exe | a09c18fab5b82583b24180cd1cd6d18f | 1 |
| 28. | nuqwsaqp.dll | c5d3f6ecf6cb264be666710546f5b900 | 1 |
| 29. | dxps2bin.exe | e86d4219c9656385f88c7b17f376e5af | 1 |