MSIL/Kryptik.UHG removal guide

The MSIL/Kryptik.UHG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What MSIL/Kryptik.UHG virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
A process created a hidden window
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Executed a process and injected code into it, probably while unpacking
Sniffs keystrokes
A process attempted to delay the analysis task by a long amount of time.
Attempts to repeatedly call a single API many times in order to delay analysis time
Steals private information from local Internet browsers
Exhibits behavior characteristic of iSpy Keylogger
Creates a hidden or system file
Checks the CPU name from registry, possibly for anti-virtualization
Creates a copy of itself
Harvests information related to installed instant messenger clients
Harvests information related to installed mail clients

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine MSIL/Kryptik.UHG?


File Info:
crc32: 4FDA786E
md5: 48fbcfa48285d163d512034b98a2bd5f
name: mnik.exe
sha1: f1b92c2f9b22fb3537beb8e76c20ff8218337b3d
sha256: 2f74b634ab07f48766f7e1c9e309ff57fd79776f965161a87adadf3e11ab4ab5
sha512: 74532f7bdeab6d90cff8b44d20784f0acb63dd36d99ed5bfff205dd71cd2f921e8d3223030616487d54fbe23953a4e83b2031622fe9342897df3f8014f81d25b
ssdeep: 24576:wclubglAhQBoGb3fADWyOrCNlmh4AyYoIxoDHv:wc4slNXnyOCy46
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9  2014
Assembly Version: 1.0.0.0
InternalName: FFXIV Nexus Progress.exe
FileVersion: 1.0.0.0
CompanyName: 
LegalTrademarks: 
Comments: 
ProductName: FFXIV Nexus Progress
ProductVersion: 1.0.0.0
FileDescription: FFXIV Nexus Progress
OriginalFilename: FFXIV Nexus Progress.exe

MSIL/Kryptik.UHG also known as:

MicroWorld-eScan	Trojan.GenericKD.32945749
FireEye	Generic.mg.48fbcfa48285d163
ALYac	Trojan.Agent.HawkEye
Sangfor	Malware
K7AntiVirus	Trojan ( 0055eb9e1 )
BitDefender	Trojan.GenericKD.32945749
K7GW	Trojan ( 0055eb9e1 )
CrowdStrike	win/malicious_confidence_90% (W)
TrendMicro	TROJ_FRS.VSNW0DA20
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
GData	Win32.Trojan.Agent.JHPXQY
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
Alibaba	Trojan:Win32/starter.ali1000139
AegisLab	Trojan.Multi.Generic.4!c
Avast	Win32:TrojanX-gen [Trj]
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.GenericKD.32945749
Sophos	Troj/Steale-IS
DrWeb	Trojan.Siggen9.179
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Generic.dc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.Crypt (A)
Ikarus	Trojan.MSIL.Krypt
Webroot	W32.Trojan.Gen
Endgame	malicious (high confidence)
Arcabit	Trojan.Generic.D1F6B655
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
Microsoft	Backdoor:MSIL/Bladabindi!MTB
Acronis	suspicious
McAfee	RDN/Generic.grp
Malwarebytes	Trojan.Crypt.MSIL
ESET-NOD32	a variant of MSIL/Kryptik.UHG
TrendMicro-HouseCall	TROJ_FRS.VSNW0DA20
Rising	Malware.Undefined!8.C (CLOUD)
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_97%
Fortinet	MSIL/Kryptik.UHG!tr
AVG	Win32:TrojanX-gen [Trj]
Cybereason	malicious.f9b22f
Panda	Trj/GdSda.A
Qihoo-360	Generic/Trojan.PSW.374

How to remove MSIL/Kryptik.UHG?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

MSIL/Kryptik.UHG removal guide