Categories: Rootkit

VirTool:WinNT/Rootkitdrv information

The VirTool:WinNT/Rootkitdrv is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What VirTool:WinNT/Rootkitdrv virus can do?

Loads a driver
Expresses interest in specific running processes
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine VirTool:WinNT/Rootkitdrv?


File Info:
crc32: 461EE945md5: 76bbb24ba485d13cd4a8f7e0aa859a3aname: HideToolz.exesha1: 336387e79f649a4aaedc1a201194d3d7090e5195sha256: a284d3be17ef72da2b9bfe5e14438ed2077da19eaae23386fdc7887b9c090d94sha512: bedba758e01309b23ccd11bf380f89fc0207ddf09aba3b4116180447f16490986baf5ea81037647fef40ec65c4c1b658f8d4edf2e485dfed20a061e2108dc155ssdeep: 1536:4rqWCQfhvJ6jYY7Nmpub8KWWDedxUU42PNC9zg2zDiH9StV:uCsJ6jToyTeoz2Pc9zrf+KVtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
0: [No Data]

VirTool:WinNT/Rootkitdrv also known as:

DrWeb	Tool.HideApp.32
MicroWorld-eScan	Gen:Variant.Application.HideProc.2
CMC	RiskTool.Win32.HideProc!O
CAT-QuickHeal	PUA.GenericPMF.S276072
McAfee	GenericRXGD-IS!76BBB24BA485
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic.pak!cobra
Sangfor	Malware
K7AntiVirus	Unwanted-Program ( 004d38111 )
BitDefender	Gen:Variant.Application.HideProc.2
K7GW	Unwanted-Program ( 004d38111 )
CrowdStrike	win/malicious_confidence_60% (W)
TrendMicro	RTKT_AGENT.ITW
Cyren	W32/Risk.LXEO-5419
Symantec	Hacktool.Rootkit
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Trojan.Hideproc-7
GData	Gen:Variant.Application.HideProc.2
Kaspersky	not-a-virus:RiskTool.Win32.HideProc.rv
Alibaba	VirTool:Win32/Rootkitdrv.471b414c
NANO-Antivirus	Riskware.Win32.HideProc.ieao
ViRobot	Adware.Hideproc.97792
SUPERAntiSpyware	Hack.Tool/Gen-HideProcess
Rising	RootKit.Win32.HideProc.l (CLOUD)
Ad-Aware	Gen:Variant.Application.HideProc.2
Sophos	Mal/ProcHide-A
Comodo	ApplicUnsaf.Win32.RiskTool.HideProc.ai001@1xra4a
Zillya	Trojan.HideProc.Win32.109
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.PUP.nh
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.76bbb24ba485d13c
Emsisoft	Gen:Variant.Application.HideProc.2 (B)
Ikarus	not-a-virus:RiskTool.Win32.HideProc
F-Prot	W32/MalwareF.JATL
MaxSecure	Trojan.Malware.8793130.susgen
Antiy-AVL	RiskWare[RiskTool]/Win32.HideProc
Endgame	malicious (high confidence)
Arcabit	Trojan.Application.HideProc.2
AegisLab	Trojan.Win32.Generic.l9d5
ZoneAlarm	not-a-virus:RiskTool.Win32.HideProc.rv
Microsoft	VirTool:WinNT/Rootkitdrv
AhnLab-V3	Win-AppCare/Rootkit.98198
MAX	malware (ai score=100)
Malwarebytes	RiskWare.HideProc
Panda	Trj/Genetic.gen
ESET-NOD32	a variant of Win32/HideProc.F potentially unsafe
TrendMicro-HouseCall	RTKT_AGENT.ITW
Tencent	Malware.Win32.Gencirc.10b4d2b2
Yandex	RiskTool.HideProc!F8Jj8Y+WuRM
SentinelOne	DFI – Malicious PE
Fortinet	Riskware/HideProc
Webroot	W32.Trojan.Gen
AVG	Win32:HideProc-N [PUP]
Cybereason	malicious.ba485d
Avast	Win32:HideProc-N [PUP]