BatBitRst Removal Guide

If you find that there has been an increase of annoying third-party ads while browsing the web, BatBitRst adware program may have slithered onto your system. It seems that this adware is related to Filetour, which is yet another ad-supported program. This malware threat is mostly spread by Russian third-party installers, i.e., software bundles, and it also uses a Russian browser extension to be able to display its possibly unsafe third-party advertisements. It is quite likely that you will find a number of other malware infections on board right now since such threats rarely spread alone. If you do not want to have first-hand experience what might happen if you engage with a corrupt advertisement and after ending up redirected to malicious websites, we advise you to act right now and remove BatBitRst along with the related browser extension and any other threat you may detect on your PC.

As we have just mentioned, this adware has been found spreading in a couple of notorious Russian bundles, including Loskad and InstallMonstr. Unfortunately for you, these installers can pack several potential and malware threats as well. This is how a lot of victims infect their system with potentially unwanted applications as well as adware programs, browser hijackers, ransomware programs, Trojans, keyloggers, backdoors, and so on. If you have infected your computer this way, it is quite likely that you have visited a suspicious file-sharing website (torrent or shareware) recently and downloaded free files or clicked on the wrong third-party ad.

You need to be cautious when landing on suspicious websites in general because they may run malicious scripts in the background that could trigger opening malicious pages in new tab or in new windows if you click anywhere on the page. Online gaming, gambling, dating, video streaming, and porn-related pages are among the most likely places where you could be exposed to unreliable third-party content, such as fake buttons, fake notifications, and ads. However, if your system is hiding malware like adware, it does not even matter if you are on a legitimate website as it can be hijacked and used to redirect you to malicious pages. This is why it may not be enough for you to delete BatBitRst from your computer. We advise you to use a trustworthy online malware scanner to detect all possible threats on your computer.

This adware program exploits a Russian browser extension (ScriptGate), which is available officially, for example, in the Chrome web store at chrome.google.com/webstore/detail/scriptgate/eeocknbjpmfgaclencnfjfkklmmfmiie. The only Russian language review says that this tool spread virus, which says it all. If you find this extension in your browser, it should be a clear sign that you have been infected and you could be exposed to risky third-party content.

There are a number of main directories where this adware may be installed in with 8-letter random names, including: %PROGRAMFILES(x86)%, %PROGRAMFILES%, %APPDATA%, %LOCALAPPDATA%, %WINDIR%\System32, and %WINDIR%\SysWOW64. We can give you a few examples how this malware infection may appear in these folders but it is possible that you will not find the same and in the same folders: OlrAUzVr, OlrAUzVr.bat, EdEGIIX.exe, aqvWXcuoNgS, aqvWXcuoNgS.bat, and so on. These files could be created in one or more of these aforementioned folders; so, when you are ready to delete BatBitRst from your system, you should scan all these directories for such malicious files.

Unfortunately, this adware can also connect to liflingren.info and download further malware infections in the background, without your knowledge. This would obviously increase the vulnerability of your system. The main function of this adware program is clearly displaying third-party advertisements in your browser or browsers. You should be careful with these ads though because they may not be reliable at all. Clicking on random ads is always risky. However, when such an adware program is on board, it gets even worse. You may drop further infections or end up losing money from your bank account by being scammed on a fake online shop site or other malicious pages. This is why it is so important that you remove BatBitRst and ScriptGate extension as well.

We have provided you with a step-by-step instruction below this report if you want to take care of this malware infection manually. We also understand that this is not for everyone. But you also need to understand that leaving any potential or malicious threat on your system could lead to further system security-related issues and your personal, sensitive information could be compromised, your files damaged, and so on. Thus, we suggest that you use a professional malware removal application like SpyHunter for the automatic protection of your PC.

How to remove BatBitRst from Windows

1. Tap Win+E.
2. Delete all the related random-name malicious files (e.g., "OlrAUzVr", "OlrAUzVr.bat", "aqvWXcuoNgS", "aqvWXcuoNgS.bat", "hFSVPvDk", and "hFSVPvDk.bat") from these possible locations:
   • %PROGRAMFILES(x86)%
   • %PROGRAMFILES%
   • %APPDATA%
   • %LOCALAPPDATA%
   • %WINDIR%\System32
   • %WINDIR%\SysWOW64
3. Delete all random-name related tasks (e.g., "OUtyCVNqAaOi", "guVuxYChKd", and "dzopercomjhar") from "%WINDIR%\System32\Tasks"
4. Empty the Recycle Bin.

How to remove ScriptGate extension from your browser

Google Chrome

1. Tap Alt+F  and select More tools.
2. Choose Extensions to open the Extension Manager.
3. Remove the ScriptGate extension by clicking on the Trash can icon on the right.
4. In the pop-up window, press Remove.