Win32/Kryptik.FKGX removal tips

The Win32/Kryptik.FKGX is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.FKGX virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Enumerates running processes
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• Authenticode signature is invalid
• A ping command was executed with the -n argument possibly to delay analysis
• Uses Windows utilities for basic functionality
• Uses Windows utilities for basic functionality
• Deletes its original binary from disk
• The sample wrote data to the system hosts file.
• Anomalous binary characteristics

How to determine Win32/Kryptik.FKGX?

File Info:
name: E4263FA44E91CF87EE63.mlw
path: /opt/CAPEv2/storage/binaries/c2975c63ab1c68bf1f3de2bc8416974a97a697b07eb5c1a4bf88a0e9f1e33100
crc32: 9795DFBF
md5: e4263fa44e91cf87ee636d03b483f7f6
sha1: 4baee240d5cc732426364a75a37dd46df36ec690
sha256: c2975c63ab1c68bf1f3de2bc8416974a97a697b07eb5c1a4bf88a0e9f1e33100
sha512: a523ecefb81f75b4b5b07648f350823d40e09b043ac825eee5b37c179fbcae82849a84527e8e2ec6589265b2ef6ee0f86ab2cb28f1f87bfb044c5a5332e2625b
ssdeep: 3072:mVnd9jp4tOt5dIL4y5uek9SnsvHeL88tAAbJLn2pHqPxp8jfQqF49tHG94oj:Cnd9atA8Uif7bVLeqafz49tG
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14624CF5ACBB52F6DE594D2B804CD267FDE360EC63742010385B8889BDF362DE9176B02
sha3_384: 8e6f3103971ca3ffb645d81798444e0a4bfc4e83da8ef3a9ba152700ce6a36d2bf207b5d73da23f6dc12ade487f39109
ep_bytes: 558bec6aff685021430068a8fd420064
timestamp: 2016-11-22 23:08:12

Version Info:
CompanyName: Borland Software Corporation
FileDescription: Borland Remote Debugging Server
FileVersion: 70.08.08.1442
InternalName: BORDBG61
LegalCopyright: Copyright © Borland Software Corporation 1990, 2001
OriginalFilename: bordbg61.exe
ProductVersion: 51.00
ProductName: Borland Remote Debugging Server
Translation: 0x0409 0x04e4

Win32/Kryptik.FKGX also known as:

How to remove Win32/Kryptik.FKGX?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.