About “AdWare.Win32.Qjwmonkey.jzo” infection

The AdWare.Win32.Qjwmonkey.jzo is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What AdWare.Win32.Qjwmonkey.jzo virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine AdWare.Win32.Qjwmonkey.jzo?

File Info:
name: EFABC88E7ABA88562AE1.mlw
path: /opt/CAPEv2/storage/binaries/4af7637c25f94b2496dbf18c5815066f5cbcccef441ac680c1a145a0e419abfb
crc32: BC816275
md5: efabc88e7aba88562ae1e6c943c2b50f
sha1: 435b4b248074875198198c42b92a2f17474aca71
sha256: 4af7637c25f94b2496dbf18c5815066f5cbcccef441ac680c1a145a0e419abfb
sha512: 281e11df3974222bfafdb0d8ae016ac29c5f63311712f43795709a98fd9dca167b7632c73a0ae6de1131f06d3dce5c9bb666b39c722040d3665ed7c3bec48d3e
ssdeep: 12288:SXGoW3fktoVWrtMarYplm6xdSXtas6zHa+ZTPeYElzC7YCaIEdaBECx0/blc:SDGgZalmWgQbu+9PeYP74daB9x4a
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18AE42339D6464C12E429DD377D21C57D10A0FC4AE69C212618C6BF8F6D76B22322EB5F
sha3_384: ffd7dae4c5f99d3b713ebc5ddceb72502b8db10cc34df4adb72ca14ddc6992a7000bb43a339aca7f9e6a19d65eff593d
ep_bytes: 60be005050008dbe00c0efffc7874c6e
timestamp: 2021-01-12 08:08:21

Version Info:
FileDescription: _
FileVersion: 6.0.0.0112
InternalName: 智能下载器.exe
LegalCopyright: Copyright (C) 2021
OriginalFilename: 智能下载器.exe
ProductName: 智能下载器.exe
Translation: 0x0804 0x04b0

AdWare.Win32.Qjwmonkey.jzo also known as:

How to remove AdWare.Win32.Qjwmonkey.jzo?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.