Trojan.Agent.MSIL.Krypt removal guide

The Trojan.Agent.MSIL.Krypt is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Agent.MSIL.Krypt virus can do?

Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Installs itself for autorun at Windows startup
Network activity detected but not expressed in API logs
Anomalous binary characteristics

How to determine Trojan.Agent.MSIL.Krypt?


File Info:
crc32: 06578BB0
md5: a4c0c4b9a041299993f669f45f33542f
name: major.exe
sha1: 42c5a414b44f5698a0170824020499f6aea617bd
sha256: effc2b4841d18a24ac00e9c181845d2618455379bd4f5256d3cd68ccdba7a4dc
sha512: 1e641c3e4b0e5e5225934d87f780352070321a4a735f6b83bf40bec700ff0f2944d23f5cc0a3c01facfefad0af051fcced53c29d24bae10be60989c5b6e82773
ssdeep: 12288:IKj1eiEzTb8SRgm7nJXpIS//RGIqlqRSx0ZBXIt6Bend:IKj1eiWYSRg2SQoIqlqcx0ZBXIt6Ynd
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Wextract                
FileVersion: 11.00.9600.16384 (winblue_rtm.130821-1623)
CompanyName: Microsoft Corporation
ProductName: Internet Explorer
ProductVersion: 11.00.9600.16384
FileDescription: Win32 Cabinet Self-Extractor                                           
OriginalFilename: WEXTRACT.EXE            .MUI
Translation: 0x0409 0x04b0

Trojan.Agent.MSIL.Krypt also known as:

MicroWorld-eScan	Gen:Variant.Strictor.238880
FireEye	Generic.mg.a4c0c4b9a0412999
ALYac	Trojan.Agent.MSIL.Krypt
Cylance	Unsafe
K7AntiVirus	Trojan ( 0055eb9b1 )
BitDefender	Gen:Variant.Strictor.238880
K7GW	Trojan ( 0055eb9b1 )
CrowdStrike	win/malicious_confidence_100% (W)
Invincea	heuristic
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
GData	Gen:Variant.Strictor.238880
Kaspersky	UDS:DangerousObject.Multi.Generic
Alibaba	Trojan:MSIL/Kryptik.b54a1036
AegisLab	Trojan.Multi.Generic.4!c
Rising	Trojan.Kryptik!8.8 (CLOUD)
Emsisoft	Gen:Variant.Strictor.238880 (B)
Comodo	.UnclassifiedMalware@0
F-Secure	Trojan.TR/Kryptik.mglel
DrWeb	Trojan.Nanocore.658
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.BadFile.jc
Trapmine	malicious.high.ml.score
Sophos	Mal/Generic-S
Ikarus	Trojan.MSIL.Crypt
Webroot	W32.Malware.Gen
Avira	TR/Kryptik.mglel
MAX	malware (ai score=85)
Microsoft	Trojan:Win32/Occamy.C
Arcabit	Trojan.Strictor.D3A520
ZoneAlarm	UDS:DangerousObject.Multi.Generic
AhnLab-V3	Malware/Win32.Generic.C2504380
McAfee	RDN/Generic.dx
Malwarebytes	Trojan.Crypt.MSIL.Generic
ESET-NOD32	a variant of MSIL/Kryptik.UHH
Tencent	Win32.Trojan.Strictor.Lnns
Fortinet	MSIL/Kryptik.UGA!tr
Ad-Aware	Gen:Variant.Strictor.238880
AVG	Win32:MdeClass
Cybereason	malicious.4b44f5
Paloalto	generic.ml
Qihoo-360	HEUR/QVM41.1.EBE5.Malware.Gen

How to remove Trojan.Agent.MSIL.Krypt?

Trojan.Agent.MSIL.Krypt removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X