Should I remove “Johnnie.20479”?

The Johnnie.20479 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Johnnie.20479 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Checks the CPU name from registry, possibly for anti-virtualization
• Creates a copy of itself
• Accessed credential storage registry keys
• Collects information to fingerprint the system
• Attempts to modify Explorer settings to prevent hidden files from being displayed

How to determine Johnnie.20479?

File Info:
name: 2D29105485A6C696D619.mlw
path: /opt/CAPEv2/storage/binaries/0006b362dd3b080443b2e8cb35bffd20428adc27a44c0262aad17885b0bc53c3
crc32: D5A7C95C
md5: 2d29105485a6c696d6194075ce1778f4
sha1: ddc2537390398367301f92ac47a48695ec97202c
sha256: 0006b362dd3b080443b2e8cb35bffd20428adc27a44c0262aad17885b0bc53c3
sha512: 94ea27514dcaacde343e1d25368dab70f4994b73f597219895dfbf995acbb34ae43ab8d704c9bff49fcaac3f508c381aaf8b4731db400c2fe4659eff85784e47
ssdeep: 6144:W+pqF6MEUSLBRXG4nPlvf9ITxSumSrZxYSx/HtRGJR+uI7:9jXG4nPlsSSio/NRO+j
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T199648C423B66CA24C7452630D0DB90784BBADB62B633F39F2F0C569C2D92276AD587C5
sha3_384: 3a3bb7df533f8066344a116ea29655f5f9dc47444edfc6a78608b027e5c7cefe68f0d09e9372cb7b780d130dfb60376f
ep_bytes: ff250020400000000000000000000000
timestamp: 2014-08-16 14:30:05

Version Info:
Translation: 0x0000 0x04b0
FileDescription: WinRAR
FileVersion: 1.3.4.0
InternalName: boteg.exe
LegalCopyright:  
OriginalFilename: boteg.exe
ProductVersion: 1.3.4.0
Assembly Version: 1.3.4.0

Johnnie.20479 also known as:

How to remove Johnnie.20479?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.