Johnnie.254890 removal guide

The Johnnie.254890 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Johnnie.254890 virus can do?

Behavioural detection: Executable code extraction – unpacking
Dynamic (imported) function loading detected
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Johnnie.254890?


File Info:
name: 85BA0709CA11ACD4A1B2.mlw
path: /opt/CAPEv2/storage/binaries/359a7b055799e3fe2c80583aa9113fdb510b4b7b45ca81e4a70c3774dfdce52f
crc32: 47C2C86D
md5: 85ba0709ca11acd4a1b2337c00cfb497
sha1: e9ee8eb1181eb872cb94dec52f4d9547554474bc
sha256: 359a7b055799e3fe2c80583aa9113fdb510b4b7b45ca81e4a70c3774dfdce52f
sha512: e1b4c8d9ff4b6062c641bd203fe9ab7ea1501feffe3b190296d221d74f8def4515bc72350bdaed597a140ffea2b6a27187e5c4968abe8c3c1da0b27a5db34ee9
ssdeep: 1536:e706scrgiUUQK+hqVYkEAD8GXN+I7fJ+aCl1fencHo:P6sMHzjzoI7h+aS1Gn3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T141938D23CE1D1A72E9B282B1087A9959592B3C321051DF1B31857F6C1972BDBB9FC31B
sha3_384: ccab9b05b1a3afb2bf5554daf81f609ef091a7745a2cbac23b8f45ac0a04c7fbc1f01928563a3665e6a899330634ae64
ep_bytes: 6868224000e8eeffffff000000000000
timestamp: 2006-04-14 10:11:18

Version Info:
Translation: 0x0409 0x04b0
CompanyName: Company
ProductName: FTS
FileVersion: 1.00
ProductVersion: 1.00
InternalName: FTS 2.1
OriginalFilename: FTS 2.1.exe

Johnnie.254890 also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 99)
CAT-QuickHeal	Trojan.WacatacVMF.S20097639
McAfee	Artemis!85BA0709CA11
Cylance	Unsafe
Sangfor	Trojan.Win32.Wacatac.C
Alibaba	TrojanDropper:Win32/Alman.de159dfc
CrowdStrike	win/malicious_confidence_60% (W)
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Bo5ijbki-9846980-0
BitDefender	Gen:Variant.Johnnie.254890
NANO-Antivirus	Trojan.Win32.Razy.iqlqdw
MicroWorld-eScan	Gen:Variant.Johnnie.254890
Avast	Win32:Patched-ABX [Trj]
Tencent	Win32.Trojan.Dropper.Ebqw
Ad-Aware	Gen:Variant.Johnnie.254890
DrWeb	Trojan.VbCrypt.250
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_FRS.0NA103CM21
FireEye	Gen:Variant.Johnnie.254890
Emsisoft	Gen:Variant.Johnnie.254890 (B)
SentinelOne	Static AI – Suspicious PE
GData	Gen:Variant.Johnnie.254890
Avira	TR/Dropper.Gen
MAX	malware (ai score=82)
Arcabit	Trojan.Johnnie.D3E3AA
Microsoft	Trojan:Win32/Ymacco.AA26
AhnLab-V3	Trojan/Win32.Wacatac.C4159981
VBA32	Trojan.VBKrypt
ALYac	Gen:Variant.Johnnie.254890
Malwarebytes	Malware.AI.2949657302
TrendMicro-HouseCall	TROJ_FRS.0NA103CM21
Yandex	Trojan.VbCrypt!gSStNokkPMk
Ikarus	Virus.Alman
Fortinet	W32/PossibleThreat
AVG	Win32:Patched-ABX [Trj]
Cybereason	malicious.9ca11a
MaxSecure	Trojan.Malware.118353301.susgen

How to remove Johnnie.254890?

Johnnie.254890 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X