What is “Babar.197114”?

The Babar.197114 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Babar.197114 virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Babar.197114?


File Info:
name: D5280AEDA93EA236807F.mlw
path: /opt/CAPEv2/storage/binaries/195a6cd1953b667f109ea66d84fc80577c3b02b276152bca764312fe629ff2c0
crc32: FD27106F
md5: d5280aeda93ea236807f4c385f4388be
sha1: 8eb2d29f0a242cbe96a1850577d425bad90a9730
sha256: 195a6cd1953b667f109ea66d84fc80577c3b02b276152bca764312fe629ff2c0
sha512: 28de2bd856fa9a2959a2cbdcf56fc9bd74dca42bebf5dcecaaa146ba11c66769bce26facdfb8878311119de30ad58466f8272b3709ed828860c0a730050ccda8
ssdeep: 3072:s6zWs3JAsgrFR7P0a99VnD+Do5PyWAUuk:s2X5yrFt0aF1xuk
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CFD38B217290D072E5920630792EFBB19ABEFC311974C453B3983BAE5E717C0963A35B
sha3_384: 8fc397db80e054610e066c2196e6c6275ca929d39dd995ae6684a25516c5b7e89e5fd062d193d64b7c2da5ed49b42b7c
ep_bytes: e82a860000e978feffff8bff558bec81
timestamp: 2014-09-19 05:37:05

Version Info:
Comments: Zoom
CompanyName: Zoom Video Communications, Inc.
FileDescription: Zoom
FileVersion: 1, 5, 411, 2013
InternalName: Zoom
LegalCopyright: Copyright (C) 2011-2012 Zoom Video Communications, Inc.  All rights reserved.
LegalTrademarks: zoom.us
OriginalFilename: Zoom_launcher.exe
ProductName: Zoom boot loader
ProductVersion: 1, 5, 411, 2013
Translation: 0x0409 0x04b0

Babar.197114 also known as:

MicroWorld-eScan	Gen:Variant.Babar.197114
FireEye	Gen:Variant.Babar.197114
BitDefender	Gen:Variant.Babar.197114
Emsisoft	Gen:Variant.Babar.197114 (B)
VIPRE	Gen:Variant.Babar.197114
McAfee-GW-Edition	BehavesLike.Win32.NetLoader.ch
GData	Gen:Variant.Babar.197114
Arcabit	Trojan.Babar.D301FA
Google	Detected
ALYac	Gen:Variant.Babar.197114
MAX	malware (ai score=82)
Panda	Trj/Genetic.gen
Ikarus	Trojan-Downloader.Win32.Generic
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Wacatac.B!tr

How to remove Babar.197114?

Babar.197114 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X