BAT/BadJoke.OW removal

The BAT/BadJoke.OW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What BAT/BadJoke.OW virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• A scripting utility was executed
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (inter-process)
• Installs itself for autorun at Windows startup
• A script process created a new process
• Uses suspicious command line tools or Windows utilities

How to determine BAT/BadJoke.OW?

File Info:
name: C80D05A1F1F4C65E26FE.mlw
path: /opt/CAPEv2/storage/binaries/b9a45c2ee381c0351fcc45697451e2bd0c00b83530029e616a5820e982a20184
crc32: 600D39BE
md5: c80d05a1f1f4c65e26fe393b44eb4038
sha1: d2ac54ab50aeafed75ef82f72eeb24301ea4493f
sha256: b9a45c2ee381c0351fcc45697451e2bd0c00b83530029e616a5820e982a20184
sha512: e53b03ab0ea425bcd5569ecbf6a7e5d4d3e870c8f2a11422a60396194ac1daafcacc0e91181eb36a5c7f7740e9c30efeeab6a9aa009d9d319b68985203b9ec5b
ssdeep: 1536:r7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf5xe4Ak:nq6+ouCpk2mpcWJ0r+QNTBf5kM
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C9937D41F3E242F7EAF10A7100A6712FA73567249724E8DBC34C3D829953AD59A3D3E9
sha3_384: a6cdb404857071ecfe099872bf239069b7b2882aac548c8d4cc7ea2992feaab3710aa3bf6350e1d0327eef17cffdb6c3
ep_bytes: 68ac00000068000000006810804100e8
timestamp: 2019-07-30 08:52:50

Version Info:
0: [No Data]

BAT/BadJoke.OW also known as:

How to remove BAT/BadJoke.OW?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.