Win32/Kryptik.BCYD removal

The Win32/Kryptik.BCYD is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.BCYD virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Collects information to fingerprint the system
• Anomalous binary characteristics

How to determine Win32/Kryptik.BCYD?

File Info:
name: 61C058BB51B1E26C31DF.mlw
path: /opt/CAPEv2/storage/binaries/263ff82ef8507bf6258b04b0aa3cd6ce1da731a1c0411d99360ae5d120336996
crc32: D8D02CC7
md5: 61c058bb51b1e26c31df869fc6ccb10c
sha1: 10e07c57c53dc94410897b2cea7cb64f4c08d6a1
sha256: 263ff82ef8507bf6258b04b0aa3cd6ce1da731a1c0411d99360ae5d120336996
sha512: c7c1c7393ec9c2ac5ddf847cbf731b11a459d224e87665b2d517bb378b81781a9ccaf0cd17c13e47d017d76bb66a19cf7acf6b37f6faa787d2d69b06c8f928eb
ssdeep: 6144:UQ3O/0bChwgTlkdsj1CD0oq0sqadC9w5xCG2MR0xZm1xSDDMySeo:UQ3O8aTqdEvn0sqa49wyDTxA+Seo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T173542364C4146C98C5D670F49EB7948883BE9B23C681161A3EDD18797C6273FF22DAE8
sha3_384: 222b0500999f37d2aac3449b42a614a005919067460472308b653d381c70c127f1bc27deb2f5f9f293eb6581ad8b2c42
ep_bytes: 8d35cc204000f81bc983ee6ead8bf0c1
timestamp: 2011-11-08 12:02:03

Version Info:
0: [No Data]

Win32/Kryptik.BCYD also known as:

How to remove Win32/Kryptik.BCYD?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.