GRouter86.exe: Virus or Signed Qihoo 360 Helper?

GRouter86.exe is not automatically a virus. The exact sample with SHA-256 d2995b2ec2e1da5925fb2f6458e7837ce68de8953a131df89cf2d89a08a47f65 is currently reported clean and carries a Qihoo 360 digital signature. Its internal name is SMLProxy64.exe. That verdict applies only to those exact bytes—not to every file that uses the same name. Check your copy’s path, signer, hash, and parent software before you keep or remove it.

If GRouter86.exe returns after deletion, that does not by itself prove a rootkit. A still-installed 360 component, updater, scheduled task, service, or another parent process may simply recreate or reinstall the helper. The correct fix is to identify and remove the parent, not repeatedly delete one child executable.

What is GRouter86.exe?

The verified sample is a 64-bit Windows executable signed by Qihoo 360 Software. Its version information identifies the product as 360软件小助手 (a 360 software helper), with the original and internal filename SMLProxy64.exe. The Gridinsoft Malware Check report for the exact submitted hash shows a clean result and a verified certificate chain.

This explains why a user may see the file on a PC that has—or previously had—360 Total Security or another 360 software component. It also explains why deleting the file while the parent software remains installed may not last. An updater or helper can put back a required component on the next launch, sign-in, or reboot.

It does not make the filename a safety certificate. Attackers and unwanted installers can rename files, and two executables with the same filename can contain completely different bytes. For a broader checklist, use our guide to check whether an EXE file is safe before running it.

Is your GRouter86.exe safe or suspicious?

How to check your exact copy

1. Find the full file path and parent process

1. Open Task Manager with Ctrl + Shift + Esc.
2. Open Details, right-click GRouter86.exe, and select Open file location.
3. In Task Manager, enable the Command line and Publisher columns when available.
4. Note which application, service, updater, or scheduled task starts the process.

An expected 360 installation context is reassuring only when it agrees with the signer and hash. A copy in a generic writable folder is a different case even if its filename looks familiar.

2. Check the digital signature

Right-click the file, select Properties, and open Digital Signatures. Select the signature and choose Details. For the known sample, the signer should identify Qihoo 360 Software (Beijing) Company Limited. A missing tab, an invalid status, or another publisher is a warning.

You can also inspect the signature in PowerShell.²

$path = 'C:\full\path\GRouter86.exe'
Get-AuthenticodeSignature -LiteralPath $path |
  Select-Object Status, StatusMessage,
    @{Name='Signer';Expression={$_.SignerCertificate.Subject}}

A valid signature shows who signed the bytes and whether Windows accepts that signature. It does not prove that the whole installation is wanted, that the file came from a safe download, or that no other malware is present.

3. Calculate the SHA-256 hash

PowerShell’s Get-FileHash uses SHA-256 by default.¹ Run:

$path = 'C:\full\path\GRouter86.exe'
Get-FileHash -LiteralPath $path -Algorithm SHA256

Compare the result carefully with:

d2995b2ec2e1da5925fb2f6458e7837ce68de8953a131df89cf2d89a08a47f65

A match means the file content is the same as the submitted sample. A mismatch does not automatically prove malware—different legitimate versions can have different hashes—but it means the clean verdict for this specific sample cannot be reused. Check the publisher, version, path, source, and behavior, or scan the different file directly.

4. Check the installed parent software

Open Settings → Apps → Installed apps and look for 360 Total Security or another clearly related 360 component. Also check Task Scheduler and Services for entries that name the same product or installation folder. Do not delete unrelated tasks or services just because they start at boot.

Why does GRouter86.exe keep coming back?

Windows software is rarely one standalone EXE. A parent application can include an updater, service, scheduled task, startup entry, installer cache, and several helpers. If you delete only GRouter86.exe, the parent may detect a missing component and restore it. Security software can also restore a quarantined file when the user allows it or when an installer repairs itself.

Use this order:

1. Record the path, hash, signer, and parent process.
2. Decide whether the parent 360 software is expected and wanted.
3. If it is unwanted, uninstall the parent application through Windows or its own uninstaller.
4. Restart the PC.
5. Check Task Manager, the original folder, Startup apps, scheduled tasks, and services again.
6. If the file returns with no legitimate parent or appears in a different path, quarantine the new copy and scan the full system.

A recurring file after a normal parent-program uninstall deserves more attention than a helper restored while its parent is still installed. That is when the launcher or persistence source—not only the filename—becomes the main evidence.

How to remove GRouter86.exe safely

If it belongs to wanted 360 software

Do not remove the helper alone. Leave it in place and use the parent program’s update or repair function if it is damaged. Downloading a replacement GRouter86.exe or SMLProxy64.exe from an EXE library is not a safe repair method.

If it belongs to unwanted 360 software

1. Close the 360 application and related tray processes.
2. Open Settings → Apps → Installed apps, find the 360 product, and choose Uninstall.
3. Follow the product uninstaller and choose permanent removal when prompted.
4. Restart Windows.
5. Remove only clearly related leftover 360 folders after confirming that the application is gone.
6. Check whether GRouter86.exe returns.

This follows the vendor’s supported uninstall sequence: remove the parent application, confirm permanent removal, restart, and then check for clearly related leftovers.³

If the unwanted component is tied to 360 browser software, follow the more specific 360 Extreme Browser removal and leftover-check sequence instead of deleting broad 360 Registry branches.

When GRouter86.exe is suspicious

Keep the copy blocked or quarantined when the hash differs and the path, signer, source, or behavior does not make sense. A security tool may remove the visible executable while a downloader, service, scheduled task, remote-access component, browser change, or bundled module remains and recreates it. A full Gridinsoft Anti-Malware scan can check the rest of the device for detections, hidden files, startup entries, scheduled tasks, services, bundled apps, and other persistence.

If the file appeared during a wider compromise and the browser, Discord, email, gaming, or financial accounts may have been exposed, do not change passwords on the possibly infected PC first. Use a known-clean device, secure the primary email account, sign out active sessions, rotate unique passwords, and enable MFA. Our account-hacked response checklist explains the order.

FAQ

References

1. Microsoft. “Get-FileHash (Microsoft.PowerShell.Utility).” Microsoft Learn, accessed July 26, 2026. https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/get-filehash
2. Microsoft. “Get-AuthenticodeSignature (Microsoft.PowerShell.Security).” Microsoft Learn, accessed July 26, 2026. https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature
3. 360 Total Security. “How To Uninstall 360 Total Security on Windows.” 360 Total Security, accessed July 26, 2026. https://www.360totalsecurity.com/en/support/how-to/uninstall/