How to remove JSOutProx RAT

What is JSOutProx

JSOutProx is a sophisticated malware classified as a Remote Access Trojan (RAT). It is primarily built using JScript, which is Microsoft’s implementation of the ECMAScript standard (commonly known as JavaScript). This malware enables remote access and control over the infected systems, allowing attackers to perform a variety of malicious activities. Detecting JSOutProx can be challenging due to its obfuscation techniques and the use of legitimate-looking files to trick users. However, several indicators of compromise (IoCs) can help identify its presence. These include its persistence mechanism, where JSOutProx writes itself to two folders and remains active after a reboot by hiding in the registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run. During its initialization phase, JSOutProx gathers important system information such as system names, IP addresses, free hard drive space, logged-on user, etc., and reaches out to a command & control server to assign the infected host a unique identifier. The malware uses Windows Script Host (WSH) and Windows Management Instrumentation (WMI) for process creation, a common tactic used by malicious artifacts. It has also been observed targeting software like Symantec VIP and the Outlook email client, indicating a focus on high-value corporate targets.

How JSOutProx infected your system

JSOutProx typically infects computers through spear-phishing campaigns, where emails with malicious JavaScript attachments masquerade as legitimate documents, such as PDFs. These attachments are often obfuscated to evade detection by antivirus software. When the user executes the attachment, the malware is deployed onto the system. The malware is known for its heavy obfuscation, using Base64 encoding to hide both readable and unreadable data, which is further protected with additional algorithms. The obfuscation makes it challenging to analyze and detect the malware. JSOutProx also uses plugins named after the functions they perform, which can range from stealing information to interfacing with other malicious artifacts.

1. Download JSOutProx Removal Tool
2. Use Windows Malicious Software Removal Tool to remove JSOutProx
3. Use Autoruns to remove JSOutProx
4. Files, folders and registry keys of JSOutProx
5. Other aliases of JSOutProx
6. How to protect from threats, like JSOutProx

Remove JSOutProx manually

Manual removal of JSOutProx by inexperienced users may become a difficult task because it does not create entries in Add/Remove Programs under Control Panel, does not install browser extensions, and uses random file names. However, there are pre-installed instruments in the Windows system, that allow you to detect and remove malware without using third-party applications. One of them is Windows Malicious Software Removal Tool. It comes with Windows Update in Windows 11, 10, 8. 8.1. For older operating system you can download it here: 64-bit version | 32-bit version.

Remove JSOutProx using Windows Malicious Software Removal Tool

1. Type mrt in the search box near Start Menu.
2. Run mrt clicking on found item.
3. Click Next button.
4. Choose one of the scan modes Quick scan, Full scan, Customize scan (Full scan recommended).
5. Click Next button.
6. Click on View detailed results of the scan link to view the scan details.
7. Click Finish button.

Remove JSOutProx using Autoruns

JSOutProx often sets up to run at Windows startup as an Autorun entry or Scheduled task.

1. Download Autoruns using this link.
2. Extract the archive and run Autoruns.exe file.
3. In Options menu make sure there are checkboxes near Hide Empty Locations, Hide Microsoft Entries, and Hide Windows Entries.
4. Search for suspicious entries with weird names or running from locations like: C:\{username}\AppData\Roaming.
5. Right-click on suspicious entry and choose Delete. This will prevent the threat to run at startup.
6. Switch to Scheduled Tasks tab and do the same.
7. To remove files themselves, click on suspicious entries and choose Jump to Entry…. Remove files or registry keys found.

Remove files, folder and registry keys of JSOutProx

JSOutProx files and folders


{randomname}.exe


JSOutProx registry keys


no information


Aliases of JSOutProx

How to protect from threats, like JSOutProx, in future

Standard Windows protection or any decent third-party antivirus (Norton, Avast, Kaspersky) should be able to detect and remove JSOutProx. However, if you got infected with JSOutProx with existing and updated security software, you may consider changing it. To feel safe and protect your PC from JSOutProx on all levels (browser, e-mail attachments, Word or Excel scripts, file system) we recommend a leading provider of internet security solutions – BitDefender. Its solutions both for home and business users proved to be one of the most advanced and effective. Choose and get your BitDefender protection via the button below: