How to remove “VirTool:Win32/Obfuscator.JO”?

The VirTool:Win32/Obfuscator.JO is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What VirTool:Win32/Obfuscator.JO virus can do?

Executable code extraction
Creates RWX memory
Unconventionial language used in binary resources: Russian
Network activity detected but not expressed in API logs

How to determine VirTool:Win32/Obfuscator.JO?


File Info:
crc32: F5AB0D89
md5: 11b4c9c8776a3729e62483d27f613e46
name: 11B4C9C8776A3729E62483D27F613E46.mlw
sha1: a556ee7d4ca455d8ba72724478679c4c6bca66d8
sha256: 5d65a40d297a79ff44fea2dbe6b97a385abf8c7b504fa68130d2cc257821208c
sha512: 12e350e129e648857d13dea38e49966d41b5db5899e11663c69bf4afa928cdf07c208deb22a02fc4878c42a1b1eae8fe513c74ddce9dba9edc085a182837c528
ssdeep: 1536:kBd4N3sO+e0x20EwAHF8zoOHOoGzO/J7B6bkrhGIAAN/UBA3kScDi5Oi3nB:qY8/QwAH+RfGzO/J7Bq5A0ScDvi3nB
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: KYlAgR
FileVersion: 6.0
CompanyName: HjE
ProductName: jdrDrpe
ProductVersion: 6.0
FileDescription: nMbTXia
OriginalFilename: iKi.exe
Translation: 0x0409 0x0000

VirTool:Win32/Obfuscator.JO also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Ransom.Cerber.1
FireEye	Generic.mg.11b4c9c8776a3729
ALYac	Trojan.Ransom.Cerber.1
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0050b7db1 )
BitDefender	Trojan.Ransom.Cerber.1
K7GW	Trojan ( 0050b7db1 )
Cybereason	malicious.8776a3
Arcabit	Trojan.Ransom.Cerber.1
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Trojan.Agent-966694
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Crypted.ubmkc
Rising	Trojan.Win32.Generic.12DFB8E7 (C64:YzY0OpT7QHJ8gwcv)
Ad-Aware	Trojan.Ransom.Cerber.1
Emsisoft	Trojan.Ransom.Cerber.1 (B)
Comodo	Malware@#1b0ouziq0qt8x
F-Secure	Trojan.TR/Crypt.XPACK.Gen
DrWeb	BackDoor.Dego.2
Zillya	Trojan.FakeAV.Win32.45200
McAfee-GW-Edition	BehavesLike.Win32.Dropper.mh
Sophos	ML/PE-A + Mal/FakeAV-BW
Ikarus	Virus.Win32.Heri
Jiangmin	Trojan.Generic.llko
Webroot	none
Avira	TR/Crypt.XPACK.Gen
MAX	malware (ai score=80)
Antiy-AVL	Trojan/Win32.AGeneric
Microsoft	VirTool:Win32/Obfuscator.JO
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.Ransom.Cerber.1
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Generic.C1913709
McAfee	GenericR-FSR!11B4C9C8776A
Panda	Trj/CI.A
ESET-NOD32	Win32/Agent.RMA
Tencent	Win32.Trojan.Bublik.gsi
Yandex	Trojan.Agent!uSjALLbARoQ
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Agent.BW
BitDefenderTheta	AI:Packer.246F9F731F
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Generic/HEUR/Malware.QVM20.Gen

How to remove VirTool:Win32/Obfuscator.JO?

VirTool:Win32/Obfuscator.JO removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X