Virus:Win32/Jeefo.C removal tips

The Virus:Win32/Jeefo.C is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Jeefo.C virus can do?

• Sample contains Overlay data
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the shellcode get eip malware family
• Created a service that was not started
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Jeefo.C?

File Info:
name: 6E2FEDA16CA7B69584BF.mlw
path: /opt/CAPEv2/storage/binaries/9a49a8737738ae3dbf16928be639a3f8e1509ce75a883de7211f8eb8bcda6a9e
crc32: 903FF829
md5: 6e2feda16ca7b69584bffb91c086075c
sha1: 0c0d931b683a6e23048d49f7cbf070b338ecf658
sha256: 9a49a8737738ae3dbf16928be639a3f8e1509ce75a883de7211f8eb8bcda6a9e
sha512: 5e4c949ad8f4aae7cc364036481ade99ca7803e6d0ee469ad4527fc1c214c30681a4c8da8748a6cc6aae4deda76dabd4e66a95f5a4650ed6ef9240331ea706ef
ssdeep: 3072:syH99g4byc6H5c6HcT66vlmm+Y1bEaznWfH22ZsuX2xKwMPTnaSrIrvDGyxCqqKj:syH7xOc6H5c6HcT66vlm0JznWjZnXeKI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F4F3C01BA5409D3ACC5606B0157B0F2A8771DCB17584D04EE7E47EAF3BB11A2E1A871F
sha3_384: c68e0a5148524f0458b030a75435119645843f6ace04f1ae0de74fc4cbdaaafee376af5f7dd7011d4941b26adc5edb8d
ep_bytes: 68f01140002bc103c133c1c300000000
timestamp: 2001-08-24 15:00:00

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Windows Features
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
InternalName: OptionalFeatures
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: OptionalFeatures.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.7600.16385
Translation: 0x0409 0x04b0

Virus:Win32/Jeefo.C also known as:

How to remove Virus:Win32/Jeefo.C?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.