Johnnie.176596 removal

The Johnnie.176596 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Johnnie.176596 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Dynamic (imported) function loading detected
• Enumerates running processes
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Installs itself for autorun at Windows startup
• Installs itself for autorun at Windows startup
• Created a service that was not started

How to determine Johnnie.176596?

File Info:
name: 1FF7CD9B689BEFAB177B.mlw
path: /opt/CAPEv2/storage/binaries/debcc5d1c280d5f25bd19a223d4e385149384db3f11940da305a755db9c92688
crc32: F90C7819
md5: 1ff7cd9b689befab177b618d48bc1df8
sha1: e0e5ad45237ee2dfb8c3206843678cf93923d251
sha256: debcc5d1c280d5f25bd19a223d4e385149384db3f11940da305a755db9c92688
sha512: b704a01357d48b1076b6c4cd4653e9aef263c9b00eabfa5bc730b1ec691dfaf2c177a100712a12bf82afb8f14e3e7549d75bb5b157b0c919e55cea9f8dd2c751
ssdeep: 6144:Gre0NTFbNSejjxBwdcBMv4I7A8lZfMEOeyIBbOzciQXdP:G6aFbDjLw6o7ZBMEUIROzcicd
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1BF44127A7382D83AF6E2853284452E375534FF298C34D65E2994BEAB7FBE35400E4523
sha3_384: 0d18485cf248175c0fc190d84e957c5dd82060f093ce19ee45b36e0bf5adac9416b3b66923c2722b00a78cab84109672
ep_bytes: 60be004042008dbe00d0fdff5783cdff
timestamp: 2018-06-28 07:00:54

Version Info:
Translation: 0x0804 0x04b0
CompanyName: Microsoft Windows 
FileDescription: Service Sample
LegalCopyright: ?2000-2020 Microsoft
ProductName: ServiceSample
FileVersion: 2.01.0166
ProductVersion: 2.01.0166
InternalName: SvSample
OriginalFilename: SvSample.exe

Johnnie.176596 also known as:

How to remove Johnnie.176596?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.