Risk

RiskTool.Win32.Miner.bag removal tips

Malware Removal

The RiskTool.Win32.Miner.bag is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What RiskTool.Win32.Miner.bag virus can do?

  • Creates RWX memory
  • Dynamic (imported) function loading detected
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine RiskTool.Win32.Miner.bag?


File Info:

name: D5FADFA4EFF7814D1C96.mlw
path: /opt/CAPEv2/storage/binaries/aa34419f3cd3e543fff9f1c8ae10946a7417fe6ea1e99e49d36816d4ae173b57
crc32: B17A03B3
md5: d5fadfa4eff7814d1c960f95aea45ddf
sha1: 237f65bf8157c8279f3a24faeed72c97536e70dc
sha256: aa34419f3cd3e543fff9f1c8ae10946a7417fe6ea1e99e49d36816d4ae173b57
sha512: dc8cd006df2780e331048e5ee8f23435c817a12867a20db11419f3e49d2932f6cd8cfb034b39dba047ef03367a92147dc2872ff4f27c6236983b981e13f30e88
ssdeep: 196608:h+0EPVowzveOv0jXKd+zvrnzNz9iTfBjLnUDs8uD5LggO+Zf/FH0lT9jovMEIbz1:rljadyvdz9uLus805NZf/FEx8MRr5ow
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AED6335E82226C72DC6E0335D559C93F47603979A221C8D59FCE1BB8E4F73B88221B5B
sha3_384: 5979cd60530a47391c064ef53901becbc61a7c0bcca21f8acb5d3e03c38ea94f8767f70a4b268bf58048a3ecdaa8b257
ep_bytes: 5589e557565381ecac010000ff157493
timestamp: 2012-02-19 15:01:49

Version Info:

CompanyName: Litecoin project
CompanyWebsite: http://www.litecoin.org/
FileDescription:
FileVersion: 0.8.7.2
LegalCopyright:
ProductName: Litecoin
ProductVersion: 0.8.7.2
Translation: 0x0000 0x0000

RiskTool.Win32.Miner.bag also known as:

LionicRiskware.Win32.Miner.1!c
CylanceUnsafe
ZillyaAdware.BrowseFox.Win32.298666
SangforCoinMiner.Win32.Miner.dig
K7AntiVirusAdware ( 005239cd1 )
AlibabaRiskWare:Win32/Miners.b70d7b3d
K7GWAdware ( 005239cd1 )
CyrenW32/S-97367561!Eldorado
SymantecTrojan.Gen.MBT
ESET-NOD32a variant of Win32/CoinMiner.BJ potentially unwanted
AvastWin32:Malware-gen
Kasperskynot-a-virus:RiskTool.Win32.Miner.bag
SophosGeneric PUA CD (PUA)
ComodoApplicUnwnt@#1mi29cbgzlsp7
VIPREBackdoor.IRCBot
MicrosoftPUA:Win32/Presenoker
McAfeeArtemis!D5FADFA4EFF7
VBA32Trojan.IRCbot
RisingPUA.BitCoinMiner!8.471 (CLOUD)
YandexTrojan.GenAsa!ZwOzrH5A2lo
FortinetW32/Bitcoin_Miner.BJ
AVGWin32:Malware-gen

How to remove RiskTool.Win32.Miner.bag?

RiskTool.Win32.Miner.bag removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment