MSIL/Kryptik.WBN removal tips

The MSIL/Kryptik.WBN is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.WBN virus can do?

The binary likely contains encrypted or compressed data.
Network activity detected but not expressed in API logs

How to determine MSIL/Kryptik.WBN?


File Info:
crc32: FE7DC1D9
md5: d399f84c5e0f4d2961bd694a29468e9c
name: svchosts.exe
sha1: eca18e9dcd5c2b08f5eb13da4ef4d0d9e3beb952
sha256: 1a95a3386cd558e16ad5c8bf2be2e16b8bd3ff4dbcbc583f1aa1ea2750ec3a81
sha512: e2516e7538d7f68f153bb9ae1db5518ff80095e3c98d64be7bd419afe657a034e95a49397bc690896e41b4c40055637d5034715771800f77c0dd6a407bc43e67
ssdeep: 6144:rVk//Rolrsoy8KuL1I3E00fH1m13M0B/nWhesORsg9AM+:i/Zo5soHbeif1mxbRn6g9
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: jZvvPMG
Assembly Version: 1.0.0.0
InternalName: jZvvPMG.exe
FileVersion: 1.0.0.0
LegalTrademarks: MJQorjh
Comments: MJQorjh
ProductName: jZvvPMG
ProductVersion: 1.0.0.0
FileDescription: MJQorjh
OriginalFilename: jZvvPMG.exe

MSIL/Kryptik.WBN also known as:

AegisLab	Trojan.Win32.Generic.4!c
Sangfor	Malware
Cybereason	malicious.dcd5c2
BitDefenderTheta	Gen:NN.ZemsilF.34122.tm0@aK7cr5f
F-Prot	W32/MSIL_Troj.VE.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.WBN
Avast	FileRepMetagen [Malware]
Kaspersky	UDS:DangerousObject.Multi.Generic
APEX	Malicious
Ad-Aware	Trojan.GenericKD.33911886
Invincea	heuristic
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
Fortinet	MSIL/Kryptik.WBN!tr
FireEye	Generic.mg.d399f84c5e0f4d29
Cyren	W32/MSIL_Troj.VE.gen!Eldorado
MaxSecure	Trojan.Malware.121218.susgen
Endgame	malicious (high confidence)
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	TrojanSpy:MSIL/AgentTesla!MTB
McAfee	Artemis!D399F84C5E0F
Ikarus	Trojan.Inject
eGambit	Unsafe.AI_Score_99%
GData	Win32.Backdoor.XpertRAT.0A4DZ4
AVG	FileRepMetagen [Malware]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_90% (W)

How to remove MSIL/Kryptik.WBN?

MSIL/Kryptik.WBN removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X