Threat Explorer




13 February 2007
Famatech LLC.
Risk Impact:
File Names:
Radmin.exe R_server.exe raddrv.dll ginstall.dll
Systems Affected:


Remacc.Radmin is a component of the remote control software, Remote Administrator.

Remote Administrator is a legitimate remote administration software. However, some of its components can be used for malicious purposes, as it allows a remote attacker to control a user's computer.


The files are detected as Remacc.Radmin.

Antivirus Protection Dates

  • Initial Rapid Release version 02 October 2014 revision 022
  • Latest Rapid Release version 03 November 2019 revision 020
  • Initial Daily Certified version 14 October 2003 revision 003
  • Latest Daily Certified version 04 November 2019 revision 060
  • Initial Weekly Certified release date 15 October 2003

Remacc.Radmin is often installed from a legitimate package to a configurable location. By default, that location is C:\Program Files\radmin. However, its component can be placed on a computer without any installation procedure.

Upon execution, Remacc.Radmin can be configured to run in stealth mode, allowing the remote attacker to control the compromised computer. The ports used are configurable.

When Remacc.Radmin is installed, it does the following:
  1. Creates the following registry subkey:


    so that a service is created.

  2. Creates a service with the following characteristics:

    Service Name: r_server
    Display Name: Remote Administrator Service

  3. Creates the following subkeys:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Remote Administrator v2.2

  4. May modify the hosts file.

  1. Update the definitions.
  2. Remove all the entries that the risk added to the hosts file.
  3. Restart tne computer in Safe mode.
  4. Run a full system scan and delete all the files detected as Remacc.Radmin.
  5. Delete any values added to the registry.

1. Updating the definitions

  1. Navigate to the following location:

    • Windows 95/98/Me:
    • Windows NT/2000/XP:


  2. Double-click the hosts file.
  3. If necessary, deselect the "Always use this program to open this program" check box.
  4. Scroll through the list of programs and double-click Notepad.
  6. Close Notepad and save your changes when prompted.

3. To restart the computer in Safe mode
Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode or VGA mode. For instructions, read the document: How to start the computer in Safe Mode .

4. Scanning for and deleting the files
Run a full system scan.
If any files are detected as Remacc.Radmin, click Delete.

5. To delete the value from the registry

Note: This procedure is optional. It is not likely that the keys, which currently known versions of this adware has added, will do any harm if they are not removed from the registry. Removal can be somewhat complex due to the randomly named files.

Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified subkeys only. Read the document: How to make a backup of the Windows registry .

  1. Click Start, and then click Run.
  2. Type regedit

    Then click OK.
  3. Navigate to and delete the registry keys:


  4. Exit the Registry Editor.