Malware

Generik.KVKRCFQ information

Malware Removal

The Generik.KVKRCFQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Generik.KVKRCFQ virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Reads data out of its own binary image
  • A process created a hidden window
  • Unconventionial language used in binary resources: Portuguese
  • The binary likely contains encrypted or compressed data.
  • Attempts to delete volume shadow copies
  • Executed a process and injected code into it, probably while unpacking
  • A system process is generating network traffic likely as a result of process injection
  • Behavior consistent with a dropper attempting to download the next stage.
  • Installs itself for autorun at Windows startup
  • Attempts to modify proxy settings
  • Attempts to modify browser security settings
  • Creates a copy of itself
  • Harvests information related to installed mail clients
  • Collects information to fingerprint the system
  • Uses suspicious command line tools or Windows utilities

How to determine Generik.KVKRCFQ?


File Info:

crc32: 648736C5
md5: b6a417899b4ae2e7e686f22183cefda0
name: B6A417899B4AE2E7E686F22183CEFDA0.mlw
sha1: 362adbe335c1753fe82af868e5b7c49c142c5c1c
sha256: 25a8d095f8d0d741dd2dca8aa9ceb9d699a5b3e1a2010f27d0ca2d5f393e1c0a
sha512: cf884b112d397176d7d2b3e0f2eec6eb30fc2aff2669d241a513b07a265535df0e8a35de9fa3bd674e0845399987d5227eefc82cdf809b687062c9d38e49a12c
ssdeep: 12288:5Ryp1jD3G+b10KkNCJgVJnbVDVo1/camYF:mv3GfIJQDcpF
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

eUp Shredder: <x0ex01FileVersion
eUp Software: Hx10x01FileDescription
Comments: @x10x01CompanyName
eUp Utilities 2014: @x0ex01ProductVersion
yright xa9 AVG Netherlands B. V. 2011: Lx12x01LegalTrademarks
eUp Utilitiesx2122: Lx16x01ProductName
0.1000.340: D
Translation: 0x0407 0x04b0

Generik.KVKRCFQ also known as:

BkavW32.AIDetect.malware2
K7AntiVirusTrojan ( 005224381 )
Elasticmalicious (high confidence)
DrWebTrojan.Encoder.761
CynetMalicious (score: 100)
CAT-QuickHealRansom.Cerber.A4
McAfeeRansomware-GCQ!B6A417899B4A
CylanceUnsafe
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojanDropper:Win32/dropper.ali1003001
K7GWTrojan ( 005224381 )
Cybereasonmalicious.99b4ae
BaiduWin32.Trojan.Kryptik.alb
CyrenW32/Locky.H2.gen!Eldorado
SymantecPacked.Generic.459
ESET-NOD32a variant of Generik.KVKRCFQ
APEXMalicious
AvastWin32:Malware-gen
KasperskyHEUR:Trojan.Win32.Vucha.dc
BitDefenderGen:Variant.Ser.Razy.8696
NANO-AntivirusTrojan.Win32.Vucha.evinmy
MicroWorld-eScanGen:Variant.Ser.Razy.8696
TencentWin32.Trojan.Generic.Pgmm
Ad-AwareGen:Variant.Ser.Razy.8696
SophosML/PE-A + Mal/EncPk-APV
ComodoTrojWare.Win32.Kryptik.ERJ@6l0vie
BitDefenderThetaAI:Packer.119331D920
VIPRETrojan.Win32.Reveton.a (v)
TrendMicroRansom_HPCERBER.SM3
McAfee-GW-EditionBehavesLike.Win32.Ransomware.hc
FireEyeGeneric.mg.b6a417899b4ae2e7
EmsisoftGen:Variant.Ser.Razy.8696 (B)
SentinelOneStatic AI – Malicious PE
AviraHEUR/AGEN.1136463
eGambitUnsafe.AI_Score_99%
MicrosoftRansom:Win32/Teerac.A
ArcabitTrojan.Ser.Razy.D21F8
AegisLabTrojan.Win32.Generic.4!c
GDataGen:Variant.Ser.Razy.8696
AhnLab-V3Trojan/Win32.RL_Cerber.R269565
Acronissuspicious
VBA32BScope.Trojan.Vucha
MAXmalware (ai score=99)
MalwarebytesMalware.AI.2900043248
PandaTrj/GdSda.A
TrendMicro-HouseCallRansom_HPCERBER.SM3
RisingBackdoor.Vawtrak!1.AEEC (CLOUD)
YandexTrojan.GenAsa!fueX/94kA18
IkarusPUA.Downloader
FortinetW32/Kryptik.FQRH!tr
AVGWin32:Malware-gen
Paloaltogeneric.ml
Qihoo-360Win32/Ransom.TorrentLocker.HgIASPkA

How to remove Generik.KVKRCFQ?

Generik.KVKRCFQ removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment