Batman_good@aol.com Ransomware Removal Guide

If your Desktop wallpaper recommends contacting the batman_good@aol.com email address, it is most likely that the computer got infected with Batman_good@aol.com Ransomware. The title might sound fun, but in reality, it is a malicious application, and it may do irreversible damage to the user’s data. For example, the malware could encipher not only personal files, such as photographs or videos but also data that belongs to Mozilla Firefox or any other third-party software. It may sound disappointing but even if you erase the malicious program, it does not undo the damage. Nonetheless, our researchers advise getting rid of Batman_good@aol.com Ransomware after you read the full article. Learning more about such threats could help understand how they work and also avoid them in the future.

For starters, we would like to explain to you how this malware enters the system. Ransomware applications are often spread either through Spam emails or malicious web pages. In this case, we believe that Batman_good@aol.com Ransomware should be distributed with infected email attachments. Of course, when you receive a file it is impossible to say whether it is infected or not from just looking at it. Still, you should notice particular details that might make such attachments look suspicious. For instance, it could come from someone you do not know or without any explanation. If you are not sure what this file might contain or why it was sent to you at all, take extra precautions, e.g. scan it with an antimalware tool.

Batman_good@aol.com Ransomware might work silently on the system, so you may not notice anything until it starts the encryption process. During its installation, the malicious program should create a few executable files in different locations and make a few Registry entries as well. Its next step is to encipher all data on the system except files that belong to Microsoft. As a result, some of the programs could crash, and it would be impossible to reload them. While it is possible to reinstall such applications, we cannot say the same for encrypted personal data. It can be recovered only if you made copies of it on removable media devices or other storages before the infection appeared. The malware adds a unique extension (e.g. id-A5512911.batman_good@aol.com.xtbl) to all encrypted files, so any file that is marked with it should be enciphered and unusable.

Then, Batman_good@aol.com Ransomware should replace user’s Desktop background with a picture titled as How to decrypt your files.jpg. This file should be in the C:\Users\user location and it is the ransom note from the malware’s creators. The text on this picture does not say much, as it simply provides contact information. It is your choice if you want to communicate with these cyber criminals, but we have to warn users that dealing with them could be dangerous. The malware’s developers could demand users to pay a ransom and promise to send a decryptor once the payment is made. The problem is that they might not bother to deliver it even if you transfer the money. In other words, you would be risking your money.

However, if you do not want to pay the ransom, you can simply eliminate the malware and secure the system. The instructions available below this text should help users erase Batman_good@aol.com Ransomware manually, although they could be a little complicated for inexperienced readers. If they appear to be too difficult, you can install a legitimate antimalware tool instead. It would help you locate the infection’s malicious data on the system and delete it automatically. Also, feel free to write us a comment below if you need any help or want to ask more questions about the threat.

Remove Batman_good@aol.com Ransomware

1. Open the Explorer and locate these paths one by one:
   %ALLUSERSPROFILE%\Start Menu\Programs\Startup
   %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup
   %USERPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
   %ALLUSERSPROFILE%\Microsoft\Windows\Start Menu\Programs\Startup
   %ALLUSERSPROFILE%\Application Data\Microsoft\Windows\Start Menu\Programs\Startup
   %WINDIR%\Syswow64
   %WINDIR%\System32
2. Search for executable files with random titles, right-click them separately and choose Delete.
3. Close the Explorer and open the RUN while pressing Windows Key+R.
4. Type regedit and click Enter.
5. Navigate to this location: HKCU\Control Panel\Desktop and find a value name called Wallpaper.
6. Right-click it, press Modify and click OK after you replace “How to decrypt your files.jpg” with another image.
7. Go to the following location: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Wallpapers and look for a value name called BackgroundHistoryPath0.
8. Right-click it, select Modify, erase “How to decrypt your files.jpg” and type a title another wallpaper.
9. Locate this particular directory: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
10. Find value names that have random titles.
11. Check if their value data points to these following locations:
    %WINDIR%\Syswow64\*.exe
    %WINDIR%\System32\*.exe
12. Mark these value names separately, right-click them and click Delete.
13. Close the Explorer. Then empty your Recycle Bin.