VHO:RiskTool.Win32.Miner removal instruction

The VHO:RiskTool.Win32.Miner is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VHO:RiskTool.Win32.Miner virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Dynamic (imported) function loading detected
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality

How to determine VHO:RiskTool.Win32.Miner?

File Info:
name: 1662DAC14D01F5E32563.mlw
path: /opt/CAPEv2/storage/binaries/3a952148b2f371628fc67ef643ab07c51f8f297fbd2277cb77b62c40e39bda19
crc32: B2F8DD0E
md5: 1662dac14d01f5e32563e1a47e334b1e
sha1: 1a25deb2bc4e77d3038fa56b8406e13d1f28f95d
sha256: 3a952148b2f371628fc67ef643ab07c51f8f297fbd2277cb77b62c40e39bda19
sha512: 67f583c05adf61b67529b17dfe502acd03a08551b4249bac3af8dfa2ada66bbd9ad8c852345dd0f7345e92189afed80e5e2e83168387d0df07272c7f8f299907
ssdeep: 49152:RQTs4p3520kj4+q4Z9UBjRS//+lCtfnNNJxHDTlNxWTCVtTjo:Rx4p35keySfCBNNvx+TG1o
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T149D533B0F3A207B6FED3803500DB644B922D762E9FA49997C79C7805B45B6E40A3E1DD
sha3_384: 95782acf8eb4db090c9af62fd2f6656f8f8ba61c7136069f554f9cd5ac10766016f04634420078d9f9de6219d28441f2
ep_bytes: 68ac00000068000000006868804100e8
timestamp: 2018-02-01 20:18:05

Version Info:
0: [No Data]

VHO:RiskTool.Win32.Miner also known as:

How to remove VHO:RiskTool.Win32.Miner?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.