TrojanSpy:Win64/Ursnif.L
Threat Scorecard
EnigmaSoft Threat Scorecard
EnigmaSoft Threat Scorecards are assessment reports for different malware threats which have been collected and analyzed by our research team. EnigmaSoft Threat Scorecards evaluate and rank threats using several metrics including real-world and potential risk factors, trends, frequency, prevalence, and persistence. EnigmaSoft Threat Scorecards are updated regularly based on our research data and metrics and are useful for a wide range of computer users, from end users seeking solutions to remove malware from their systems to security experts analyzing threats.
EnigmaSoft Threat Scorecards display a variety of useful information, including:
Popularity Rank: The ranking of a particular threat in EnigmaSoft’s Threat Database.
Severity Level: The determined severity level of an object, represented numerically, based on our risk modeling process and research, as explained in our Threat Assessment Criteria.
Infected Computers: The number of confirmed and suspected cases of a particular threat detected on infected computers as reported by SpyHunter.
See also Threat Assessment Criteria.
| Threat Level: | 80 % (High) |
| Infected Computers: | 177 |
| First Seen: | September 6, 2012 |
| Last Seen: | September 15, 2023 |
| OS(es) Affected: | Windows |
The detection of TrojanSpy:Win64/Ursnif.L indicates that your system has been compromised by a type of spyware. This malicious software is designed to gather sensitive information from your computer without your knowledge or consent. It's essential to take immediate action to remove the threat and protect your personal data.
Table of Contents
What Is TrojanSpy:Win64/Ursnif.L?
TrojanSpy:Win64/Ursnif.L is a type of malware that falls under the category of spyware. Spyware is a malicious software that secretly monitors and collects user data, such as login credentials, browsing history, and other sensitive information. The name TrojanSpy:Win64/Ursnif.L suggests that it is a Trojan horse-type malware that targets 64-bit Windows systems and has spyware capabilities.
How TrojanSpy:Win64/Ursnif.L Operates
TrojanSpy:Win64/Ursnif.L operates by infiltrating your system and hiding in the background, making it difficult to detect. Once installed, it can start collecting sensitive information, such as keystrokes, screenshots, and network traffic. This information can be sent to a remote server, where it can be used for malicious purposes, such as identity theft, financial fraud, or other cybercrimes. The malware may also create backdoors, allowing hackers to access your system remotely and perform further malicious activities.
Symptoms of Infection
The symptoms of a TrojanSpy:Win64/Ursnif.L infection can be subtle, but some common signs include slow system performance, unusual network activity, and unfamiliar programs or icons on your desktop. You may also notice that your browser is being redirected to unfamiliar websites or that your search results are being manipulated. Additionally, you may receive unexpected pop-ups or alerts, or your system may crash frequently.
- Unexplained changes to your system settings or configuration
- Unfamiliar programs or icons on your desktop
- Slow system performance or frequent crashes
- Unusual network activity or unfamiliar websites
- Unexpected pop-ups or alerts
How to Remove TrojanSpy:Win64/Ursnif.L
- Boot your system in Safe Mode with Networking to prevent the malware from loading and to allow for easier removal.
- Perform a full scan of your system using a reputable anti-malware tool, such as SpyHunter, to detect and remove the malware.
- Uninstall any suspicious programs or applications that you don't recognize or that were installed without your knowledge.
- Reset your web browsers, such as Chrome, Firefox, or Edge, to their default settings to remove any malicious extensions or add-ons.
- Reboot your system and perform another full scan to ensure that the malware has been completely removed.
Conclusion
Removing TrojanSpy:Win64/Ursnif.L from your system requires immediate attention and careful action. By following the steps outlined above, you can help protect your personal data and prevent further damage to your system. It's essential to remain vigilant and to take proactive measures to prevent future infections, such as keeping your operating system and software up to date, using strong antivirus software, and being cautious when clicking on links or downloading attachments from unknown sources. By taking these steps, you can help ensure the security and integrity of your system and protect yourself from the risks associated with spyware and other types of malware.
Aliases
15 security vendors flagged this file as malicious.
| Antivirus Vendor | Detection |
|---|---|
| AVG | Generic29.PNG |
| Fortinet | W32/Weelsof.EM!tr |
| Ikarus | Trojan.Win32.Weelsof |
| Sophos | Mal/Weelsof-A |
| AntiVir | TR/Weelsof.em |
| Comodo | TrojWare.Win32.Agent.VAUGA |
| BitDefender | Trojan.Generic.KDV.697751 |
| Kaspersky | Trojan.Win32.Weelsof.em |
| Symantec | W32.Pilleuz!gen35 |
| McAfee | Artemis!F5B1313C9437 |
| AVG | Dropper.Generic6.BHOD |
| Fortinet | W32/Zbot.ADN!tr |
| Ikarus | Trojan-Dropper.Win32.Necurs |
| AhnLab-V3 | Spyware/Win32.Zbot |
| AntiVir | TR/Drop.Necurs.wk.1 |
File System Details
| # | File Name | MD5 |
Detections
Detections: The number of confirmed and suspected cases of a particular threat detected on
infected computers as reported by SpyHunter.
|
|---|---|---|---|
| 1. | NEUSBw32.dll | c06a18bb345bbfe8158ab88f1f1f4b04 | 90 |
| 2. | gpmm.sys | 7ed96b2529369f06a15d0d519a23f4c9 | 22 |
| 3. | gpmn.sys | 0ee3ceec262efea90b216c8379e2a4c8 | 22 |
| 4. | syshost.exe | 90dab3b41bd3c980616be7b143f1bc5a | 19 |
| 5. | svchost.exe | 6df7d966590f20e7137210a08f2f0c5d | 10 |
| 6. | zm7w6yqsxb.exe | 7ceed788a1fbb0e5d356e49ccd2e9b0a | 9 |
| 7. | oicjbwbl.exe | f5b1313c943710ee93b3bda2fa1a7c44 | 2 |
| 8. | powedVol64.dll | 77bc865798da73f9f7dd9b4eef3cb40a | 1 |
| 9. | 00016368.exe | c7241f6ef4d5884ee61b1b8412f6cdd1 | 1 |
