MSIL/GenKryptik.EONH removal

The MSIL/GenKryptik.EONH is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/GenKryptik.EONH virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
The binary likely contains encrypted or compressed data.
Executed a process and injected code into it, probably while unpacking
Network activity detected but not expressed in API logs

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine MSIL/GenKryptik.EONH?


File Info:
crc32: 9664126D
md5: e2d02ddb2404895ae240d10317cb3c85
name: turkguyz.exe
sha1: ab057f39b6ef10d0d62b86de5f2be7f385667302
sha256: 902fadead04c4fb1a114b1d2a10337f9be13f257e2fde1db05de58edf77300f7
sha512: 2c0a541787dac436aabfff356d80df858c8585cb55be1075609aa4313d8ccd1e55f170be7c3d55db67e0f6c62d0d28509a602a57929d55d8cb379e4f91b8d4d1
ssdeep: 24576:kDRJudWk20ZskfxRkXhNfxWVrE3oDJHi:k7uT20ZsPxNpWVruodHi
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Novel by Honorxe9 de Balzac
Assembly Version: 3.0.164.5
InternalName: hqjVR.exe
FileVersion: 3.0.136.7
CompanyName: Novel by Honorxe9 de Balzac
LegalTrademarks: Le Pere Goriot
Comments: Le Pere Goriot
ProductName: Les Misxe9rables
ProductVersion: 3.0.136.7
FileDescription: Les Misxe9rables
OriginalFilename: hqjVR.exe

MSIL/GenKryptik.EONH also known as:

FireEye	Generic.mg.e2d02ddb2404895a
McAfee	Fareit-FXI!E2D02DDB2404
Cylance	Unsafe
Cybereason	malicious.9b6ef1
F-Prot	W32/MSIL_Kryptik.BDT.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
Alibaba	Trojan:Win32/Kryptik.ali2000016
AegisLab	Trojan.MSIL.Agensla.i!c
Endgame	malicious (high confidence)
Trapmine	malicious.moderate.ml.score
SentinelOne	DFI – Malicious PE
Cyren	W32/MSIL_Kryptik.BDT.gen!Eldorado
Avira	TR/Kryptik.czpes
Microsoft	Trojan:Win32/Wacatac.D9!ml
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
VBA32	CIL.HeapOverride.Heur
Malwarebytes	Trojan.Crypt.MSIL
ESET-NOD32	a variant of MSIL/GenKryptik.EONH
TrendMicro-HouseCall	TROJ_GEN.R002H0AGK20
Rising	Trojan.GenKryptik!8.AA55 (CLOUD)
Ikarus	Trojan-Spy.MassLogger
Fortinet	W32/Agensla.EONH!tr.pws
BitDefenderTheta	Gen:NN.ZemsilF.34136.5m0@aq0gPI
AVG	FileRepMetagen [Malware]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)
Qihoo-360	Generic/Trojan.PSW.374

How to remove MSIL/GenKryptik.EONH?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

MSIL/GenKryptik.EONH removal