Should I remove “MSIL/Kryptik.ZDI”?

The MSIL/Kryptik.ZDI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Kryptik.ZDI virus can do?

Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine MSIL/Kryptik.ZDI?


File Info:
crc32: DC7468A2
md5: 75edb7694cc730e726f76c1b7d66e7aa
name: 75EDB7694CC730E726F76C1B7D66E7AA.mlw
sha1: 77229809af014acd7f1d62f0cd7a029f3d19c394
sha256: c40f80c23d8ff7cf3f28c2959f7017ac88cc12f7df50669c341a9a5add4bf76a
sha512: 1fd4e2e2204c36c2664f8bded2ab2b98805e01b7831bcd430b1539a2238f09498b090e15d7d077a0b92f476d490ba0836b4015faaa3237525d531079faa97532
ssdeep: 6144:0yPCCCCCKCCCCCKCCCCCKCCCCCKCCCCC:bCCCCCKCCCCCKCCCCCKCCCCCKCCCCC
type: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2016 NGWIN
CompanyName: NGWIN
LegalTrademarks: 9a019080 a810 42d3 90bf 93d396050b9a
Comments: 051b2f7e 7702 4d3d 8be9 2c4d2122094c
ProductName: A universal clipboard managing app that makes it easy to access your clipboard from anywhere on any device.
FileDescription: A universal clipboard managing app that makes it easy to access your clipboard from anywhere on any device.
Guid: 71b4d58a-11bc-4f23-8737-d24173fe20f4
Translation: 0x0000 0x04e4

MSIL/Kryptik.ZDI also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Autoruns.GenericKD.35980599
FireEye	Generic.mg.75edb7694cc730e7
CAT-QuickHeal	Trojan.Multi
Qihoo-360	Generic/Backdoor.23a
McAfee	PWS-FCTJ!75EDB7694CC7
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Multi.Generic.4!c
Sangfor	Malware
K7AntiVirus	Trojan ( 0057568c1 )
BitDefender	Trojan.Autoruns.GenericKD.35980599
K7GW	Trojan ( 0057568c1 )
Cybereason	malicious.94cc73
Cyren	W32/Trojan.MCPP-0385
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.MSIL.Remcos.gen
Alibaba	Trojan:Win32/Kryptik.ali2000016
Ad-Aware	Trojan.Autoruns.GenericKD.35980599
Sophos	Mal/Generic-S
Comodo	Malware@#30a6raycsve8u
F-Secure	Trojan.TR/Dropper.MSIL.kurnw
DrWeb	Trojan.DownLoader36.31737
TrendMicro	TROJ_GEN.R002C0PA321
McAfee-GW-Edition	PWS-FCTJ!75EDB7694CC7
Emsisoft	Trojan.Autoruns.GenericKD.35980599 (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Dropper.MSIL.kurnw
MAX	malware (ai score=88)
Antiy-AVL	Trojan[Backdoor]/MSIL.Remcos
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Backdoor:Win32/Rescoms.C!bit
Gridinsoft	Trojan.Win32.Kryptik.oa
Arcabit	Trojan.Autoruns.Generic.D2250537
ZoneAlarm	HEUR:Backdoor.MSIL.Remcos.gen
GData	Trojan.Autoruns.GenericKD.35980599
Cynet	Malicious (score: 90)
AhnLab-V3	Malware/Win32.RL_Generic.C4285538
BitDefenderTheta	Gen:NN.ZemsilF.34742.in0@a0V0AMdi
ALYac	Trojan.Autoruns.GenericKD.35980599
Malwarebytes	Trojan.Crypt.MSIL
Panda	Trj/GdSda.A
Zoner	Trojan.Win32.100176
ESET-NOD32	a variant of MSIL/Kryptik.ZDI
TrendMicro-HouseCall	TROJ_GEN.R002C0PA321
Tencent	Win32.Backdoor.Remcos.Auto
Ikarus	Trojan.MSIL.Inject
eGambit	Unsafe.AI_Score_100%
Fortinet	MSIL/Kryptik.ZDI!tr
AVG	Win32:RATX-gen [Trj]
Avast	Win32:RATX-gen [Trj]
CrowdStrike	win/malicious_confidence_80% (D)

How to remove MSIL/Kryptik.ZDI?

MSIL/Kryptik.ZDI removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X