Prevx Research Division
RADTOOLS.EXE
Cloaked MalwareThe most common objects with the name of RADTOOLS.EXE are considered safe.
You can use our free Webroot Cloud AntiVirus Beta to thoroughly check your PC for spyware and other infections. It is free and takes less than 2 minutes to run. To start the scan just click the blue button.
Associated Malware Groups
The unsafe files using this name are associated with the malware group:
- Cloaked Malware
File Behavior
RADTOOLS.EXE has been seen to perform the following behavior:
- This process creates other processes on disk
- This Process Deletes Other Processes From Disk
- The Process is packed and/or encrypted using a software packing process
- Executes a Process
- Creates system tray popups, messages, errors and security warnings
- Adds products to the system registry
RADTOOLS.EXE has been the subject of the following behavior:
- Executed by Internet Explorer
- Created as a process on disk
- Executed as a Process
- Deleted as a process from disk
- Has code inserted into its Virtual Memory space by other programs
- Registered as a Dynamic Link Library File
Country Of Origin
The filename RADTOOLS.EXE was first seen on Apr 12 2008 in the following geographical regions of the Webroot community:
- Spain on Apr 12 2008
- India on Apr 12 2008
- Italy on Nov 4 2008
- Australia on Jan 15 2009
- Brazil on Oct 12 2011
- Slovakia on May 5 2012
Filesizes
The following file size has been seen:
- 1,322,863 bytes
- 1,507,942 bytes
- 1,491,872 bytes
- 1,323,272 bytes
- 1,316,170 bytes
- 1,557,975 bytes
File Type
The filename RADTOOLS.EXE refers to many versions of an executable program.
File Activity
One or more files with the name RADTOOLS.EXE creates, deletes, copies or moves the following files and folders:
- Creates c:\docume~1\user\locals~1\temp\GLKA.tmp
- Creates c:\windows\~GLH0000.TMP
- Deletes c:\docume~1\user\locals~1\temp\GLBF.tmp
- Creates c:\docume~1\user\locals~1\temp\GLG11.tmp
- Creates c:\docume~1\user\locals~1\temp\~GLH0001.TMP
- Deletes c:\docume~1\user\locals~1\temp\GLF13.tmp
- Moves c:\docume~1\user\locals~1\temp\~GLH0001.TMP to c:\docume~1\user\locals~1\temp\GLF13.tmp
- Creates c:\windows\system32\GLBSINST.%$D
- Deletes c:\windows\system32\GLBSINST.%$D
Help the Webroot Community to fight cyber crime
We are always looking for ways to improve the quality and speed of research to help us protect you from malicious software and cyber crime.
PCMag.com Editors' Choice Award Logo is a trademark of Ziff Davis Publishing Holdings Inc. Used under license.