HackTool:Win32/ActivateRadmin removal guide

The HackTool:Win32/ActivateRadmin is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What HackTool:Win32/ActivateRadmin virus can do?

Reads data out of its own binary image
Unconventionial language used in binary resources: Russian
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine HackTool:Win32/ActivateRadmin?


File Info:
crc32: 6ABA0BE7
md5: 04794e53976f9f9c756904e4115ce7d8
name: dll.exe
sha1: 750496c0e14357b23a26acd648ead7fab85f5076
sha256: 87e04280020030a2cea9ea38127d5d79b5729c929adc2955c13181e699895101
sha512: b6cb1ed8ae48bea214f25ea0cee802bb71d1f9376aeee366df193b52f7d82ceac4baa7c88f23cf1cea587883a927e6116bb282101801bce0f0aae111b5e8a547
ssdeep: 6144:VZXBsWqsE/Ao+mv8Qv0LVmwq4FU0nN876A4mvbasgs+xZIooa3hlzCjr:TXmwRo+mv8QD4+0N46A4mvbrCk0hR8r
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Key                                                                                                 
FileDescription: Key 1.00 Installation                                       
FileVersion: 1.00                
Comments: 
CompanyName: Key                                                         
Translation: 0x0409 0x04e4

HackTool:Win32/ActivateRadmin also known as:

MicroWorld-eScan	Application.Newtstop.A
McAfee	Artemis!04794E53976F
Cylance	Unsafe
K7AntiVirus	Unwanted-Program ( 004d38111 )
BitDefender	Application.Newtstop.A
K7GW	Unwanted-Program ( 004d38111 )
Cyren	W32/Risk.YWCC-7587
Symantec	ML.Attribute.HighConfidence
TotalDefense	Win32/Jorik.KJ
Avast	Win32:PUP-gen [PUP]
GData	Application.Newtstop.A
Alibaba	HackTool:Win32/ActivateRadmin.d80ca851
NANO-Antivirus	Trojan.Win32.Inject.gtwe
Rising	Malware.Undefined!8.C (CLOUD)
DrWeb	Trojan.Inject1.34981
Invincea	heuristic
McAfee-GW-Edition	MultiDropper-JD.b
SentinelOne	DFI – Suspicious PE
Trapmine	malicious.moderate.ml.score
FireEye	Generic.mg.04794e53976f9f9c
Emsisoft	Application.Newtstop.A (B)
APEX	Malicious
Antiy-AVL	Trojan[Packed]/Win32.PePatch
Arcabit	Application.Newtstop.A
Microsoft	HackTool:Win32/ActivateRadmin
MAX	malware (ai score=86)
Panda	Trj/CI.A
ESET-NOD32	Win32/HideIcon.A potentially unsafe
eGambit	Unsafe.AI_Score_99%
AVG	Win32:PUP-gen [PUP]
MaxSecure	Trojan-Ransom.Win32.Crypmod.zfq

How to remove HackTool:Win32/ActivateRadmin?

HackTool:Win32/ActivateRadmin removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X