Remove Jmp2.in Redirect – Adware Virus

For users who know their way around the computer and have the capability to diagnose malware using their skills and understand how to use utility tools available in the system.

Step 1: Check the Hosts file for unwanted entries

Malware can hijack the browser and the computer network by inserting unwanted lines of IP addresses and websites in order to redirect the user’s browser without their consent.

The hosts file is a common point of target for malware developers since they are located deep into the computer system, making it harder for non-tech-savvy individuals to find, moreover, understand the contents inside it.

1. To start, open the Notepad program as an administrator. This is because admin privilege is needed to access the host file.

2. Inside the Notepad application, click File, and inside the dropdown menu, select Open.

3. Heading over to the following directory: C:\Windows\System32\drivers\etc and open the hosts file.

4. Once the hosts file has opened in the Notepad, you may notice entries that are added by Microsoft and legitimate programs. But you may also see suspicious entries that you may not entirely recognize.

5. To remove them, simply delete the following entries from the hosts file. After that, click CTRL+ S to save the changes you made to the file. On the other hand, you can click File and select Save from the dropdown.

Step 2: Use Process Explorer to detect and remove malware

Malware threats alongside Jmp2.in could have been hiding in the system as Windows services and processes. If the malware is a service, it can have bad effects on the computer system as a whole.

They can create or modify existing services, basically tainting them, particularly for persistence, but can also be used for granting further privileges to malware inside an infected system.

In order to find unwanted services as well as processes from running in the computer and causing further harm, we will be using Process Explorer, an alternative to the Windows Task Manager and is a part of the Sysinternals suite.

Here are some of the features of Process Explorer:

• Hierarchical relationship and connection between processes.
• Identify which processes have loaded DLLs, and opened/locked certain files and folders.
• It can kill a process tree including any newly spawned processes.
• Simplifies analysis with a color-coded list of processes.

Process Explorer is a tool that is frequently used to analyze malware which is why it is the perfect fit to use in this particular case.

How to find and remove malware via Process Explorer:

1. Download and run Process Explorer from the official Microsoft download page.

2. Upon opening the tool, you will see a list of processes running on the system. Alongside them have a designated color based on the type and current state of the process.

3. Now we will begin hunting for malware using Process Explorer. There are many ways to find malware within the vast number of processes shown. You can narrow down the scope to Services, Packed Images, and Jobs and exclude a few like Suspended Services and Deleted Objects.

Here are the ways you can check if a process is malware:

• An unreadable process name is an indication that something is not quite right.
• Find the file path of every suspected process. A Dllhost service that is currently located at the Temp file will most likely be malware in disguise.
• Check the developer name and description of each process you suspect. Most system processes will have Microsoft Corporation as their developer name and every app you have installed will show the company name that developed them.
• See which processes are hogging a great amount of CPU resources. This is another indicator that malware is installed in the system.

4. We can also verify if an executable file or a DLL has trusted signatures by enabling the Verify Image Signatures from the Options tab in the menu bar.

5. To further dig deep into the suspected process, we can submit it to VirusTotal and check if their antivirus engines have already been flagged as malware. We can do this by clicking Options on the top menu bar and clicking VirusTotal.com. Now you can right-click the processes and the Check Virustotal.com option will be enabled.

6. Once you have determined that a certain process is malware. Whether all suspected conditions are met or VirusTotal has flagged it numerous times. Kill/terminate the said process, open its path, and delete it from the system. (Tip: You can see its file location by hovering your mouse over the process.)

You may be able to find two or more malicious items therefore you should carefully look for suspicious processes before exiting the Process Explorer.

Step 3: Find and remove startup malware with Autoruns

Autoruns is another tool that is a part of the Sysinternals suite. It is a piece of software that is used to find processes that are configured to run upon system boot-up or whenever a user logs in to the computer.

We will use Autoruns to find threats inside a compromised system. Any installed malware will have the capability to survive a computer reboot.

1. First off, download the Autoruns tool from the official Microsoft website. Extract the zip folder and begin running the tool.

2. If this is the first time you have used Autoruns, then you may be probably overwhelmed at first. It consists of multiple tabs that each contain autostart mechanisms.

Here are what to expect in each tab:

• Logon: It displays the details for standard startup locations such as for installed programs and all the users on the computer.
• Explorer: This includes shell extensions, Browser Helper Objects, Explorer Toolbars, and Active Setup Executions. You may see a great number of DLL files within this tab.
• Internet Explorer: This tab displays a more in-depth look at the web browser which shows Browser Helper Objects, Toolbars, and Extensions that are installed within the browser.
• Scheduled Tasks: It displays the tasks that are set to execute upon system boot or user login. This is commonly used by malware therefore looking into the tasks that seem suspicious will lead you to the malware executable.
• Services: This tab shows all Windows services that are set to run upon boot. Normally, there should not be any suspicious processes within this tab. But malware may cloak itself as a system process as a persistence mechanism so it might be worthwhile to check.
• Drivers: It allows a piece of hardware such as the keyboard and mouse to communicate with the system. This tab displays all registered drivers that the computer used.
• Image Hijacks: This tab will show all registry settings that redirect and control how a certain program or executable will be loaded. It is worthwhile to check this tab as there is a great chance that you will find malware.

There are more tabs within Autoruns but the ones mentioned above are where you will want to check for malware.

3. In order to make the search for malware easier, we can exclude verified processes and entries from displaying. To do this, click Options, from the menu bar then tick Hide Microsoft Entries.

4. Now, check the tabs for malicious entries. We can do so by checking whether the entry has a verified publisher and a description. The Image Path also indicates where the file is located, so a suspicious directory such as the Temp folder will be a red flag.

5. After investigating the files, we can right-click the file/s of suspicion and click Check VirusTotal to scan the entry for malware. This will scan the entry using multiple antivirus engines. (The scan results will be displayed on the right corner of the entry next to the Timestamp.)

6. Once VirusTotal has displayed how many antivirus vendors have flagged the file as malicious. Right-click the entry and select Delete to stop it from running. Confirm the deletion by selecting Yes when prompted if you are sure you want to do so.

Step 4: Use Norton Power Eraser

Norton Power Eraser can be described in a single word: false positives. The tool is notorious for not leaving any trace of malware unnoticed on the computer, therefore it always detects normal processes and programs as well.

The reason this is in the advanced steps is because it requires the skill to be able to discern between legitimate and harmful programs. In this instance, the Norton Power Eraser is an extremely effective tool to utilize. It effectively narrows your search for malware related to Jmp2.in.

1. To begin with, download Norton Power Eraser from the official website.

2. NPE.exe would have begun downloading on the computer. Wait for it to finish then run it afterwards.

3. If the User Account Control window pops up, click Yes.

4. Read the program’s license agreement and click Agree. You will only be prompted upon the first launch.

5. Once the Norton Power Eraser home menu has opened, select Settings, toggle the Include Rootkit Scan option, and click Apply. This will allow the program to scan for hidden malware on the computer. Do note that this will require a computer restart.

6. After the system has restarted, open Norton Power Eraser, select Full System Scan, and click Run Now to start the process.

7. Wait for the scanning process to finish. This will depend on how many files you have on your computer, as well as the hardware capabilities of your system.

8. Once the scan is complete, Norton Power Eraser will show all the detected threats onscreen. Take action by clicking Delete/Fix on the right side of each item. After that, click Close to finish the process. On the other hand, if no threats are found, click Done.

Norton Power Eraser is a portable tool that does not need to be installed to work. Therefore you can always run it at your disposal whenever you believe your computer is infected with malware you cannot find.