What is “Worm:VBS/Jenxcus.E!rfn”?

The Worm:VBS/Jenxcus.E!rfn is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Worm:VBS/Jenxcus.E!rfn virus can do?

• Sample contains Overlay data
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities to create a scheduled task
• Detects Bochs through the presence of a registry key
• Checks the version of Bios, possibly for anti-virtualization
• Attempts to modify proxy settings
• Attempts to interact with an Alternate Data Stream (ADS)
• Collects information to fingerprint the system
• Uses suspicious command line tools or Windows utilities
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Worm:VBS/Jenxcus.E!rfn?

File Info:
name: 3834F1E8E0CDE13B3063.mlw
path: /opt/CAPEv2/storage/binaries/a362922bc542ee43727b24da915ecc0ec572057214f8b6ad9ec7a0ae2f44bfda
crc32: A15BBC11
md5: 3834f1e8e0cde13b3063116fba78ddbb
sha1: 1417b8e889912b8af4a81a516d9f3588375f134e
sha256: a362922bc542ee43727b24da915ecc0ec572057214f8b6ad9ec7a0ae2f44bfda
sha512: 42ca1436a4703b09e5307f5a2b15d20f7e5693a660760c36ffa062fab335d1eb962b6d6197c39c4762f3d19f46bce1e2096236c412dada740b35363e6a8d3ff2
ssdeep: 196608:I1ctjlt0OhRFE1qVUMh1Um7QzYOkAYB0aWAJHWEb5g3AlObUqm5XLdjbTeKySyNi:AoJRFsoum7OHaCou3AleFm5Zj+K3p492
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1DDD63309EAE38AB1E59E09331D51FF0EAC74AD5335068A39BFF2B3DDC9625623114B50
sha3_384: 5366fd470688cb2c8098458ebe865134786ae6d9dd1867a0afb40d0228db0decddaec1db61e7bd0e4e5529b7a3c702b4
ep_bytes: e8ce040000e98efeffff3b0dc8a14300
timestamp: 2018-09-30 18:01:44

Version Info:
CompanyName: ByClick
FileDescription: 
FileVersion: 2.2.108
InternalName: YouTubeByClick-Setup
LegalCopyright: Copyright (C) 2019 ByClick
OriginalFileName: YouTubeByClick-Setup.exe
ProductName: YouTube By Click
ProductVersion: 2.2.108
Translation: 0x0409 0x04b0

Worm:VBS/Jenxcus.E!rfn also known as:

How to remove Worm:VBS/Jenxcus.E!rfn?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.