What is “Win32/Pronny.EJ”?

The Win32/Pronny.EJ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Pronny.EJ virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• CAPE detected the embedded win api malware family
• Attempts to disable Windows Auto Updates
• Anomalous binary characteristics
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine Win32/Pronny.EJ?

File Info:
name: 6DB0B03A81B41E12B17C.mlw
path: /opt/CAPEv2/storage/binaries/2f6f7391859496fdbb5666eabbaced18318862358eea7ff36fc66e7e4deac2c0
crc32: 57FBE67B
md5: 6db0b03a81b41e12b17c12a2f7af308b
sha1: 6e7051664d22c5578d17d6048476ccf0baa39d2e
sha256: 2f6f7391859496fdbb5666eabbaced18318862358eea7ff36fc66e7e4deac2c0
sha512: 197af8f4e687cdab3d6f6612b8f4e30fa374df40155b3ee2abad0cb1ad7ea7fc80e77dbc8bed29382cd9c0a7c87b147f9b13f77088d6e57241625dfe852375af
ssdeep: 6144:9sCcLyc5mFpvMTuGSouFQIlzBI1Iq3Fdrj6DUKSpFw+x:Shuc5mFpxzBI1X3Fdrj6DUKSpx
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19D24E93562C0BB3AE1A2C7F439D983925429AC3234B5680BF7C11F3577E5E97962072B
sha3_384: 2bca40c02084d6da2611d477829ade66a92110b841177574279ee4d603d1f1d3f2c290be672b3c6dc2ce857a89761104
ep_bytes: 688c3a4000e8f0ffffff000000000000
timestamp: 2012-09-19 18:19:57

Version Info:
Translation: 0x0409 0x04b0
ProductName: Cephalalgy
FileVersion: 0.94
ProductVersion: 0.94
InternalName: enterotome
OriginalFilename: enterotome.exe

Win32/Pronny.EJ also known as:

How to remove Win32/Pronny.EJ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.