MSIL/Riskware.BadJoke.A removal guide

The MSIL/Riskware.BadJoke.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Riskware.BadJoke.A virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Dynamic (imported) function loading detected
• Unconventionial language used in binary resources: Japanese
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Installs itself for autorun at Windows startup
• Binary compilation timestomping detected
• Uses suspicious command line tools or Windows utilities

How to determine MSIL/Riskware.BadJoke.A?

File Info:
name: F933CADAC61B154D70F5.mlw
path: /opt/CAPEv2/storage/binaries/a1944cf79cbc556362b2b1037f9bba5c6fa78c70082ef3ac6990a564c740289b
crc32: 5BB6AB5C
md5: f933cadac61b154d70f5773887a41b5a
sha1: cd1fe4227ab1c12d3a49c220c3eaa7ab39e7ede1
sha256: a1944cf79cbc556362b2b1037f9bba5c6fa78c70082ef3ac6990a564c740289b
sha512: edc7a25c75829feba0bcae9ceede0a1fd1b4d8000ceff19cbbe9898735b7c6ddd54cfdde1da2de4bd7c163eafa704865a398767e429ad82bbc7c0cd0cd1e2c57
ssdeep: 3072:WahKyd2n3155GWp1icKAArDZz4N9GhbkrNEkUIypgx3RhwDGW1U+FCTOe2+M9a:WahOdp0yN90QExARhLaU+Y4+3
type: PE32+ executable (GUI) x86-64, for MS Windows
tlsh: T15F44CF0A63E410A6E4B657B198F602935A72BCB14B7586FF22D4D57E0E337C0A532F27
sha3_384: d2dd2616cdf430b5f8ec6ca6901b69924cf12dd5ae9083437f9d7467dae157cc97a165f74dc3b25d65fda05d3a4a5cf4
ep_bytes: 4883ec28e85b0700004883c428e90600
timestamp: 2062-07-25 12:18:00

Version Info:
CompanyName: Microsoft Corporation
FileDescription: Win32 キャビネット 自己展開ツール
FileVersion: 11.00.19041.1288 (WinBuild.160101.0800)
InternalName: Wextract                
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: WEXTRACT.EXE            .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.19041.1288
Translation: 0x0411 0x04b0

MSIL/Riskware.BadJoke.A also known as:

How to remove MSIL/Riskware.BadJoke.A?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.