About "Win32/GenKryptik.EVBB" infection

The Win32/GenKryptik.EVBB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/GenKryptik.EVBB virus can do?

Executable code extraction
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
A process created a hidden window
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
Uses Windows utilities for basic functionality
Installs itself for autorun at Windows startup
Creates a copy of itself
Anomalous binary characteristics

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/GenKryptik.EVBB?


File Info:
crc32: CD6A92E0
md5: ed24aa88634e32b244f46b6544a99983
name: kv.gif
sha1: fc943d2b003d33c244a1af88e4dbc857285e490f
sha256: 849a64c544c1befe1033bf7feac06b4e6fd897a02680616c1753d0b6d90d5721
sha512: 5c7d555cd8fcdcec89fda4e37e763547d126b294ced347c75890f02554e6fe0191b318566d2289448e803f43bf7a4a3788dc6f8c5271a7a70e8efcd5a11cb434
ssdeep: 6144:qdtJ9rtpMBa7CSqNF2+Nlu/of4jHwr68M:qd1rMBgCSqY+Nloof4Hw2
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 Headlight Software, Inc.  All rights reserved.
InternalName: AdminPrivSetting.exe
FileVersion: 1.0.6.5
CompanyName: Headlight Software, Inc.
ProductName: (Shared by Headlight Software Products)
ProductVersion: 1.0.6.5
FileDescription: Change Settings that need Admin Privileges
OriginalFilename: AdminPrivSetting.exe
Translation: 0x0409 0x04e4

Win32/GenKryptik.EVBB also known as:

Bkav	W32.AIDetectVM.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.44193498
FireEye	Generic.mg.ed24aa88634e32b2
CAT-QuickHeal	Trojan.Qakbot
McAfee	RDN/Qakbot
Cylance	Unsafe
Sangfor	Malware
K7AntiVirus	Spyware ( 0040f0131 )
BitDefender	Trojan.GenericKD.44193498
K7GW	Spyware ( 0040f0131 )
CrowdStrike	win/malicious_confidence_90% (W)
Cyren	W32/Trojan.JJLQ-5636
Symantec	Packed.Generic.459
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
Kaspersky	Trojan.Win32.Zenpak.axyu
Alibaba	Trojan:Win32/GenKryptik.6fe8e6dd
Rising	Malware.Obscure/Heur!1.A89E (CLASSIC)
Ad-Aware	Trojan.GenericKD.44193498
Sophos	Mal/Generic-S
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.Inject4.3909
Invincea	Mal/Generic-S
McAfee-GW-Edition	RDN/Qakbot
Emsisoft	Trojan.Crypt (A)
Ikarus	Trojan.Win32.Krypt
Avira	TR/Dropper.Gen
MAX	malware (ai score=80)
Antiy-AVL	GrayWare/Win32.Kryptik.ehls
Microsoft	Trojan:Win32/Qakbot.AR!MTB
Arcabit	Trojan.Generic.D2A256DA
SUPERAntiSpyware	Trojan.Agent/Generic
ZoneAlarm	Trojan.Win32.Zenpak.axyu
GData	Trojan.GenericKD.44193498
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Kryptik.R353992
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34590.py0@aGnHXEei
ALYac	Trojan.GenericKD.44193498
TACHYON	Trojan/W32.Agent.247296.JZ
VBA32	BScope.Malware-Cryptor.Hlux
Panda	Trj/GdSda.A
ESET-NOD32	a variant of Win32/GenKryptik.EVBB
TrendMicro-HouseCall	TROJ_GEN.R002H0CJQ20
Tencent	Malware.Win32.Gencirc.10ce0e43
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	W32/GenKryptik.EVBB!tr
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Generic/HEUR/QVM20.1.D866.Malware.Gen

How to remove Win32/GenKryptik.EVBB?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About “Win32/GenKryptik.EVBB” infection