Categories: Risk

Should I remove “RiskTool.Win32.StartPage”?

The RiskTool.Win32.StartPage is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What RiskTool.Win32.StartPage virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Sniffs keystrokes
Tries to unhook or modify Windows functions monitored by Cuckoo

How to determine RiskTool.Win32.StartPage?


File Info:
name: B997706C99238E7F69B7.mlwpath: /opt/CAPEv2/storage/binaries/5cf48936bbf641507034c18be4fdef80b15dfe93b23f801f12ba66d944498e1ccrc32: 91EAF308md5: b997706c99238e7f69b771a0578d1f07sha1: 36ff827058882428c02abedae98148c961f28b62sha256: 5cf48936bbf641507034c18be4fdef80b15dfe93b23f801f12ba66d944498e1csha512: d2a1aaaee26b5a40734f7b5cb18754a8bfeabe510fb129d29e3bb291f7c877b20c307608ef3750e30ef8362acb2c65d723d07b3fd3727caee7e29dd8183c8650ssdeep: 24576:sb+HRHVHvwdMSjLKmvOeA/MKmpQsgTmpQsgTG39mpQsgS:sb+HRdRSj2mWeAxGgTGgTWGgStype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17A75AD157BF6C8B2D680243005B22739EAB68F410A168B4BE79CFE6D5F3B7D19E23115sha3_384: a2bb23f8062269c6e46ab1266585eafed6a355237d58ecc33ada585d7cec47b248493e1cf1ab57503db92a7b9c187fc9ep_bytes: 558bec6aff687025520068a4ac450064timestamp: 2015-03-04 10:11:31
Version Info:
FileVersion: 1.0.0.0FileDescription: QQ游戏大厅挤房器ProductName: QQ游戏大厅挤房器ProductVersion: 1.0.0.0CompanyName: 作者：★冰河★网670847663LegalCopyright: 作者：★冰河★网670847663 版权所有Comments: QQ游戏大厅挤房器Translation: 0x0804 0x04b0

RiskTool.Win32.StartPage also known as:

Lionic	Trojan.Win32.Generic.lte9
Elastic	malicious (high confidence)
FireEye	Generic.mg.b997706c99238e7f
CAT-QuickHeal	Trojan.Generic.2919
McAfee	Artemis!B997706C9923
Cylance	Unsafe
Sangfor	Suspicious.Win32.Cassini_f9070846.ibt
K7AntiVirus	Trojan ( 005246d51 )
Alibaba	RiskWare:Win32/FlyStudio.355d8a5f
K7GW	Adware ( 004b87ea1 )
Cybereason	malicious.058882
BitDefenderTheta	Gen:NN.ZexaE.34114.Ir0@ayLIpwhb
Cyren	W32/Agent.EW.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/FlyStudio.HackTool.A potentially unwanted
Paloalto	generic.ml
ClamAV	Win.Trojan.Agent-583204
Kaspersky	not-a-virus:HEUR:RiskTool.Win32.StartPage.gen
NANO-Antivirus	Riskware.Win32.StartPage.eanajt
Avast	Win32:Malware-gen
Comodo	Worm.Win32.Dropper.RA@1qraug
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.th
Sophos	Generic PUA DG (PUA)
Ikarus	Trojan.Rogue
GData	Win32.Trojan.PSE.1THOGOA
Jiangmin	Trojan/Generic.aerrb
Avira	TR/Rogue.1617920.16
Antiy-AVL	Trojan/Generic.ASCommon.FA
Kingsoft	Win32.Troj.GenericKD.v.(kcloud)
Gridinsoft	Ransom.Win32.Wacatac.sa
ViRobot	Trojan.Win32.Z.Rogue.1617920
Microsoft	Trojan:Win32/Wacatac.B!ml
Cynet	Malicious (score: 100)
Acronis	suspicious
MAX	malware (ai score=99)
Malwarebytes	Trojan.MalPack.FlyStudio
APEX	Malicious
Rising	Malware.Heuristic!ET#83% (RDMK:cmRtazrvtvd8mnYOOQhWQfgP87uB)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/CoinMiner.65CA!tr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_70% (D)