How to remove “MSIL/GenKryptik.FVQA”?

The MSIL/GenKryptik.FVQA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/GenKryptik.FVQA virus can do?

Dynamic (imported) function loading detected
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous .NET characteristics

How to determine MSIL/GenKryptik.FVQA?


File Info:
name: 948DDD0544DADFB3EF57.mlw
path: /opt/CAPEv2/storage/binaries/89896484e621d17aa769204d89df3174a2943c2c2a44a834acd978e3c7ba5eec
crc32: 54F908BD
md5: 948ddd0544dadfb3ef577f659e391abf
sha1: 464245158499460d8b4d78046541717d80b1af1d
sha256: 89896484e621d17aa769204d89df3174a2943c2c2a44a834acd978e3c7ba5eec
sha512: 9472894cd79d62b203a2acc6388f0701bc18ad2bb06067afc022091e574b9a52a297320415657d01cf95a3637b527565a3446955f4677adb8ec5afe279ac1b62
ssdeep: 192:0mnNTXAebyxww6bc3pq66g2A04V1GMd5lDSS6qVnP/KbVu0flQYY8t:0mNTXed6biqjgU4/jXDSzcGVntHp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A3920C45DA8DD213E8600670DC9B02F34A2FED16E4F2891FBE9C3C167B7755A60227A6
sha3_384: 4121a100df1a70be980b87a9eccdc79a8088f24d64fbcddf0ed26e01cdeb658c7e5e1eef9cac627864e0c7dd3db8937f
ep_bytes: ff250020400000000000000000000000
timestamp: 2022-06-04 02:23:14

Version Info:
Translation: 0x0000 0x04b0
Comments: Resource Hacker Setup                                       
CompanyName:                                                             
FileDescription: Resource Hacker Setup                                       
FileVersion: 0.0.0.0
InternalName: Rgelhtsj.exe
LegalCopyright: Copyright © 1998 - 2019 Angus Johnson.                                                              
LegalTrademarks: 
OriginalFilename: Rgelhtsj.exe
ProductName: Resource Hacker                                             
ProductVersion: 0.0.0.0
Assembly Version: 0.0.0.0

MSIL/GenKryptik.FVQA also known as:

Bkav	W32.AIDetectNet.01
Elastic	malicious (high confidence)
FireEye	Generic.mg.948ddd0544dadfb3
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Alibaba	TrojanSpy:MSIL/Stealer.77bf2fb8
BitDefenderTheta	Gen:NN.ZemsilF.34712.bm0@a4Gxu6b
ESET-NOD32	a variant of MSIL/GenKryptik.FVQA
APEX	Malicious
Kaspersky	HEUR:Trojan-Spy.MSIL.Stealer.gen
Avast	Win32:SpywareX-gen [Trj]
Trapmine	malicious.high.ml.score
Microsoft	Trojan:Win32/Wacatac.B!ml
AhnLab-V3	Trojan/Win.Injection.C5158480
Malwarebytes	Trojan.Downloader.MSIL.Generic
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/GenKryptik.FVQA!tr
AVG	Win32:SpywareX-gen [Trj]

How to remove MSIL/GenKryptik.FVQA?

MSIL/GenKryptik.FVQA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X