Should I remove “Babar.29738”?

The Babar.29738 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Babar.29738 virus can do?

• Behavioural detection: Executable code extraction – unpacking
• At least one process apparently crashed during execution
• Creates RWX memory
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Creates a hidden or system file

How to determine Babar.29738?

File Info:
name: 015B17BC76560D66074C.mlw
path: /opt/CAPEv2/storage/binaries/40e7578b138476427f19fd0f38e7f7d5caf98c24ff8f47a0986c56e3337ddf7c
crc32: 3962DCB7
md5: 015b17bc76560d66074c39c06cf75365
sha1: 4fd3e1e7b50186b58513c820085d856650296eaf
sha256: 40e7578b138476427f19fd0f38e7f7d5caf98c24ff8f47a0986c56e3337ddf7c
sha512: dabd6953b1dba2fded7be777a7fe2d62216127a38d3f370d78108dea9f374664340d2ea6cd0765db03823c1f48ff47306a83a301398485173fadd84192ef6555
ssdeep: 12288:kPs5J+4/ovSLFcS+snWkBnMD9Z8UO7Zz/IkAlCzlhJ6P0GeudK5q29U:k03/oqCRJTc7IkA6lhcP0GeN53U
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T10F15D0B4971420DFD42B6F3B35C9B9F4897423AC331A5C62ACEF584A02AC76BC364947
sha3_384: b79b6e4917246dc177231d1ecba69741449d593a90b0adc83046749b59501feaf7496d53d0559f32cc8551b496ead4ce
ep_bytes: 5150528d0d18000000648b0101c801c8
timestamp: 2005-08-04 10:16:24

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Self-Extracting Cabinet
FileVersion: 6.1.0022.4 (SRV03_QFE.031113-0918)
InternalName: SFXCAB.EXE
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: SFXCAB.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 6.1.0022.4
Translation: 0x0409 0x04b0

Babar.29738 also known as:

How to remove Babar.29738?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.