Risk

RiskTool.Win32.Qhost.pl information

Malware Removal

The RiskTool.Win32.Qhost.pl is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What RiskTool.Win32.Qhost.pl virus can do?

  • Executable code extraction
  • Presents an Authenticode digital signature
  • Creates RWX memory
  • Reads data out of its own binary image
  • The binary likely contains encrypted or compressed data.
  • Writes a potential ransom message to disk
  • Anomalous binary characteristics

How to determine RiskTool.Win32.Qhost.pl?


File Info:

crc32: 723A8098
md5: 3a3fe9c56a4a0f82f4389aca9fb9ee21
name: run.exe
sha1: 0826f5be47604b0ee034159d0ba1f241ddc4a189
sha256: bbc184f6e2ee74ec4db0671ecb7550b4d05e32d2ed86318ae292ee6b998346c2
sha512: badddd11d0d742cd6acf962f27b738a82b665687c54193f43d9ce9bcfb315178e545b5774b880e0d221b190b92209c2b910eeb35de1cab577116df9b7406bc0b
ssdeep: 393216:cX1fTIwCteW6EW8VMg1OuqMDBfwyHzNRfY0eU:cRTWte8MqOuq7yHRRfY0eU
type: PE32 executable (console) Intel 80386, for MS Windows

Version Info:

LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Microsoft.Windows.SoftwareLogo.ShowDesktop.exe
FileVersion: 10.0.17763.132 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Windows App Certification Kit
ProductVersion: 10.0.17763.132
FileDescription: Desktop Switch Utility
OriginalFilename: Microsoft.Windows.SoftwareLogo.ShowDesktop.exe
Translation: 0x0409 0x04b0

RiskTool.Win32.Qhost.pl also known as:

MicroWorld-eScanTrojan.GenericKD.42728406
McAfeeArtemis!3A3FE9C56A4A
AegisLabTrojan.Win32.Generic.4!c
SangforMalware
K7AntiVirusRiskware ( 0040eff71 )
BitDefenderTrojan.GenericKD.42728406
K7GWRiskware ( 0040eff71 )
Cybereasonmalicious.e47604
Paloaltogeneric.ml
GDataTrojan.GenericKD.42728406
Kasperskynot-a-virus:RiskTool.Win32.Qhost.pl
AlibabaRiskWare:Win32/Qhost.8f6f08c7
RisingTrojan.Detplock!8.4A0D (CLOUD)
Ad-AwareTrojan.GenericKD.42728406
SophosGeneric PUA AI (PUA)
F-SecureTrojan.TR/Crypt.XPACK.Gen
McAfee-GW-EditionArtemis!PUP
FireEyeTrojan.GenericKD.42728406
EmsisoftTrojan.GenericKD.42728406 (B)
AviraTR/Crypt.XPACK.Gen
Antiy-AVLRiskWare[RiskTool]/Win32.Qhost
Endgamemalicious (high confidence)
ArcabitTrojan.Generic.D28BFBD6
ZoneAlarmnot-a-virus:RiskTool.Win32.Qhost.pl
MicrosoftTrojan:Win32/Wacatac.C!ml
MAXmalware (ai score=86)
VBA32Trojan.Fuerboos
TrendMicro-HouseCallTROJ_GEN.R011H07BT20
IkarusTrojan.Crypt
eGambitPE.Heur.InvalidSig
AVGWin32:Malware-gen
AvastWin32:Malware-gen
CrowdStrikewin/malicious_confidence_80% (W)

How to remove RiskTool.Win32.Qhost.pl?

RiskTool.Win32.Qhost.pl removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment