Malware

Win32/Geksone.B removal

Malware Removal

The Win32/Geksone.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
DOWNLOAD NOW
6-day free trial available.

What Win32/Geksone.B virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid
  • Anomalous binary characteristics

How to determine Win32/Geksone.B?



File Info:

name: DF3B8E6BB054ABEFE37A.mlw
path: /opt/CAPEv2/storage/binaries/488b50a1da616019cfc4d0a20b8c89b639086cbac1c90e123c7d0a34b052fd00
crc32: DCF08548
md5: df3b8e6bb054abefe37a8173e7114f77
sha1: d49a52fb9e03501d7435ccbe8ec75006cf384e08
sha256: 488b50a1da616019cfc4d0a20b8c89b639086cbac1c90e123c7d0a34b052fd00
sha512: 7fbc022c093508e9c4abfb4413767166797ef625fb66c0c62bc914af8edad77a19bd85afa5f856732b9632a7e9cece1d2fcecff813f0217b38d71e7d2b42ba57
ssdeep: 384:l7Cb6qqHjLMZJ9N+fmWN0WLW6ZwLWW29i8AKaRv4Igr2cUSR:9CiiN2FBW78A/RvyQu
type: PE32 executable (console) Intel 80386, for MS Windows
tlsh: T11CB2CA0262E90229E2B73B34C5B616764A337C609938D25D119CD9DE1BF3E409DF3BA7
sha3_384: b460ff69e3084edffc93d1cc996889b296f991d845f192c23dfaac50bc879900c4f3fb6200bed729baf031c6d6630a29
ep_bytes: 609ce8000000005d81ed071040008db5
timestamp: 2001-08-17 20:57:08


Version Info:

CompanyName: Microsoft Corporation
FileDescription: TCP/IP Route Command
FileVersion: 5.1.2600.0 (xpclient.010817-1148)
InternalName: route.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFilename: route.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.0
Translation: 0x0409 0x04b0

Win32/Geksone.B also known as:

BkavW32.GeksoneHQcA.PE
LionicVirus.Win32.Crytex.lJfl
Elasticmalicious (high confidence)
DrWebWin32.Siggen.15
MicroWorld-eScanWin32.Crytex.A
FireEyeGeneric.mg.df3b8e6bb054abef
SkyhighBehavesLike.Win32.Pate.mt
McAfeeArtemis!DF3B8E6BB054
Cylanceunsafe
ZillyaVirus.Geksone.Win32.1
SangforVirus.Win32.Crytex.V5ht
K7AntiVirusVirus ( 0040f5911 )
AlibabaVirus:Win32/Geksone.00a58470
K7GWVirus ( 0040f5911 )
CrowdStrikewin/malicious_confidence_100% (D)
BitDefenderThetaGen:NN.ZexaF.36802.bq0@aGZkrlmi
SymantecML.Attribute.HighConfidence
tehtrisGeneric.Malware
ESET-NOD32Win32/Geksone.B
APEXMalicious
TrendMicro-HouseCallPE_CRYTEX.A
ClamAVWin.Virus.Hublo-1
KasperskyVirus.Win32.Crytex.1290
BitDefenderWin32.Crytex.A
NANO-AntivirusVirus.Win32.Crytex.bzelsx
AvastWin32:Cryte
RisingVirus.Geksone!1.AD16 (CLASSIC)
EmsisoftWin32.Crytex.A (B)
GoogleDetected
F-SecureMalware.W32/Crytex.1290
BaiduWin32.Virus.Crytex.a
VIPREWin32.Crytex.A
TrendMicroPE_CRYTEX.A
SophosW32/NGVCK-W
IkarusVirus.Win32.Virut
GDataWin32.Virus.Golem.A
VaristW32/Crytex.1290
AviraW32/Crytex.1290
Antiy-AVLVirus/Win32.Crytex.1290
Kingsoftmalware.kb.a.1000
GridinsoftVirus.Win32.Virut.sa
XcitiumVirus.Win32.Crytex.1290@4wzy41
ArcabitWin32.Crytex.A
ZoneAlarmVirus.Win32.Crytex.1290
MicrosoftVirus:Win32/Geksone.EC!MTB
CynetMalicious (score: 100)
Acronissuspicious
VBA32Virus.Win32.Crytex.1290
ALYacWin32.Crytex.A
MAXmalware (ai score=86)
TencentVirus.Win32.Crytex.a
SentinelOneStatic AI – Malicious PE
MaxSecureVirus.W32.Crytex.1290
FortinetW32/Geksone.B
AVGWin32:Cryte
DeepInstinctMALICIOUS
alibabacloudVirus:Win/Hublo.A(dyn)

How to remove Win32/Geksone.B?

Win32/Geksone.B removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • “Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

You may also like

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

View all posts

Leave a Comment