How to remove “Win32/GenKryptik.EORI”?

The Win32/GenKryptik.EORI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/GenKryptik.EORI virus can do?

Executable code extraction
Creates RWX memory
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs

How to determine Win32/GenKryptik.EORI?


File Info:
crc32: 6CA3151A
md5: f78a592013454dfaf555a5390b437a77
name: w2lyqZKpNh1Auao.exe
sha1: bcd91a3b495c22c51133b0f3ae91e399aa9b469f
sha256: 467b7b5031fb23e4e160be57af8b384fb34420b58b72ebd452e579cc82fce872
sha512: 44922e9f76b0a8170beecc856ce38409f6a9ce70a1780fedb2dcda2ac17b616dd63743b47de7c785cc2b40e47ac533606e6b5daad7518ff6a4c2776801fd7812
ssdeep: 6144:h5FdA9+3bkRQIwYEgRy2k46fifql0B1V8fLzaWS03nxyhXU:hvdA9SGh9rBylaeatanxn
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) DCUtility 2002
InternalName: Chat Client
FileVersion: 1.0B
CompanyName: DCUtility
PrivateBuild: 
LegalTrademarks: All Rigths Reseved
Comments: Enjoy the net!
ProductName: Chat Client Application
SpecialBuild: 
ProductVersion: 1.0B
FileDescription: Chat With US Client
OriginalFilename: Chat Client.EXE
Translation: 0x0409 0x04b0

Win32/GenKryptik.EORI also known as:

Bkav	W32.AIDetectVM.malware1
MicroWorld-eScan	Trojan.Emotet.AIK
FireEye	Trojan.Emotet.AIK
McAfee	GenericRXAA-AA!F78A59201345
Malwarebytes	Trojan.Emotet
K7AntiVirus	Trojan ( 0056af871 )
BitDefender	Trojan.GenericKDZ.68906
K7GW	Trojan ( 0056af871 )
ESET-NOD32	a variant of Win32/GenKryptik.EORI
APEX	Malicious
GData	Trojan.GenericKDZ.68906
Kaspersky	UDS:DangerousObject.Multi.Generic
Rising	Trojan.Kryptik!1.C89F (CLASSIC)
Ad-Aware	Trojan.Emotet.AIK
DrWeb	Trojan.DownLoader34.2817
Emsisoft	Trojan.GenericKDZ.68906 (B)
MAX	malware (ai score=85)
Endgame	malicious (high confidence)
Arcabit	Trojan.Emotet.AIK
ZoneAlarm	UDS:DangerousObject.Multi.Generic
Microsoft	Trojan:Win32/Emotet.ARJ!MTB
Panda	Trj/GdSda.A
Fortinet	W32/Kryptik.HEEL!tr
Paloalto	generic.ml
Qihoo-360	HEUR/QVM07.1.BB20.Malware.Gen

How to remove Win32/GenKryptik.EORI?

Win32/GenKryptik.EORI removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X