What is “MSIL/Kryptik.XAG”?

The MSIL/Kryptik.XAG is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.XAG virus can do?

Network activity detected but not expressed in API logs

How to determine MSIL/Kryptik.XAG?


File Info:
crc32: A37C76C7
md5: cfd7c1f8740ca02f97a919d1ad537a1d
name: terfdcv.exe
sha1: f431b3e905bd1a45e0b0856d31962f71d985a398
sha256: 8c2d2663a4c8cf961eb6e47123054f1dd40a7c23bf663762b0f0fc827b6b44f7
sha512: 16f7831628cf8f918afcdd8be12151aa3b1f986f5f1054e34ed6144527effc5d9fdae6f05f939ccbb433ba1e540dc404da8e139f7310fb147ec2ae6f14e1450e
ssdeep: 12288:K8m4k7f5e0arUJ+mpU2H077df9U4h0y+6J6b1X4eLpy3Qm:KQ0f54OrUjLZ1XyCWA
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
Translation: 0x0000 0x04b0
LegalCopyright: Copyright xa9 2001 - 2019
Assembly Version: 0.0.0.0
InternalName: terfdcv.exe
FileVersion: 4.6.8.10
CompanyName: kM)94#aB%eF73
Comments: e/5FGc(6j*9S!Mx7X
ProductName: Kw9+6(bBC7/ni
ProductVersion: 4.6.8.10
FileDescription: Kw9+6(bBC7/ni
OriginalFilename: terfdcv.exe

MSIL/Kryptik.XAG also known as:

MicroWorld-eScan	Trojan.GenericKDZ.68932
FireEye	Generic.mg.cfd7c1f8740ca02f
McAfee	Fareit-FVT!CFD7C1F8740C
Cylance	Unsafe
BitDefender	Trojan.GenericKDZ.68932
Invincea	heuristic
BitDefenderTheta	Gen:NN.ZemsilF.34138.3m0@aeV9mSi
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
ClamAV	Win.Malware.Formbook-7399661-0
GData	Trojan.GenericKDZ.68932
Kaspersky	HEUR:Trojan-PSW.MSIL.Agensla.gen
Endgame	malicious (high confidence)
Emsisoft	Trojan.GenericKDZ.68932 (B)
SentinelOne	DFI – Malicious PE
Microsoft	Trojan:MSIL/FormBook.KC!MTB
Arcabit	Trojan.Generic.D10D44
ZoneAlarm	HEUR:Trojan-PSW.MSIL.Agensla.gen
ALYac	Trojan.GenericKDZ.68932
Panda	Trj/GdSda.A
ESET-NOD32	a variant of MSIL/Kryptik.XAG
Rising	Stealer.Formbook!1.C470 (CLOUD)
MAX	malware (ai score=85)
Fortinet	MSIL/Kryptik.WZR!tr
Ad-Aware	Trojan.GenericKDZ.68932
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	HEUR/QVM03.0.C7DB.Malware.Gen

How to remove MSIL/Kryptik.XAG?

MSIL/Kryptik.XAG removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X