How to remove “Win32/Kryptik.GIND”?

Malware Removal

The Win32/Kryptik.GIND is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Win32/Kryptik.GIND virus can do?

  • Executable code extraction
  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Compression (or decompression)
  • Attempts to connect to a dead IP:Port (1 unique times)
  • Creates RWX memory
  • The binary likely contains encrypted or compressed data.
  • The executable is compressed using UPX
  • Executed a process and injected code into it, probably while unpacking
  • Attempts to repeatedly call a single API many times in order to delay analysis time
  • Installs itself for autorun at Windows startup
  • Checks the presence of disk drives in the registry, possibly for anti-virtualization

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Win32/Kryptik.GIND?


File Info:

crc32: D8347DEB
md5: 99e396818680f3ae7c277f6887e9a9bd
name: 99E396818680F3AE7C277F6887E9A9BD.mlw
sha1: 0b04b21351fd6513410e1f8e669f4574df27f9ca
sha256: 9c1c2f1b00912be86332a337e07528223c5584167dc5a5c831acbc8b228c0a9b
sha512: 8b451692032e4cb380244c8648867bd4a288bcd600ae482675e15b50f4123efd8b349eed4ad9e8f5b8a41982a812ae6e189c9be065e78d65f36e7e3f77a82daa
ssdeep: 24576:aHrpgv8xGvH0NfUqdhKDOeOllUYOMlY1B7cP2:qev8xSWfUqdhOOTMtOP2
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:

LegalCopyright: (C) 2007-2015
InternalName: Unfamiliarity Adaptability
FileVersion: 7.8.2.267
CompanyName: ZocDoC
PrivateBuild: 7.8.2.267
LegalTrademarks: (C) 2007-2015
Comments: Shoulder Byron 500k Ces Larger Tain
ProductName: Unfamiliarity Adaptability
Languages: English
ProductVersion: 7.8.2.267
FileDescription: Shoulder Byron 500k Ces Larger Tain
OriginalFilename: Unfamiliarity Adaptability.exe
Translation: 0x0409 0x04b0

Win32/Kryptik.GIND also known as:

BkavW32.AIDetect.malware1
K7AntiVirusTrojan ( 00537c2e1 )
Elasticmalicious (high confidence)
CynetMalicious (score: 100)
ALYacGen:Variant.Ransom.Scarab.43
CylanceUnsafe
AlibabaTrojan:Win32/Yakes.9e8b7211
K7GWTrojan ( 00537c2e1 )
Cybereasonmalicious.18680f
SymantecML.Attribute.HighConfidence
ESET-NOD32a variant of Win32/Kryptik.GIND
APEXMalicious
AvastWin32:Malware-gen
KasperskyTrojan.Win32.Yakes.wtfc
BitDefenderGen:Variant.Ransom.Scarab.43
NANO-AntivirusTrojan.Win32.Yakes.ffjwhe
MicroWorld-eScanGen:Variant.Ransom.Scarab.43
TencentWin32.Trojan.Yakes.Hxgd
Ad-AwareGen:Variant.Ransom.Scarab.43
SophosMal/Generic-S
ComodoMalware@#26raqgyvzykkb
BitDefenderThetaGen:NN.ZexaF.34688.@mKfaKc21cmi
McAfee-GW-EditionBehavesLike.Win32.TrojanAitInject.fc
FireEyeGeneric.mg.99e396818680f3ae
EmsisoftGen:Variant.Ransom.Scarab.43 (B)
JiangminTrojan.Yakes.aahi
AviraHEUR/AGEN.1121150
MicrosoftTrojan:Win32/Occamy.C
ArcabitTrojan.Ransom.Scarab.43
AegisLabTrojan.Win32.Yakes.4!c
GDataGen:Variant.Ransom.Scarab.43
McAfeeArtemis!99E396818680
MAXmalware (ai score=81)
VBA32BScope.Trojan.Yakes
PandaTrj/GdSda.A
RisingTrojan.Kryptik!8.8 (CLOUD)
YandexTrojan.Yakes!coNiuDbwxI0
IkarusTrojan.Win32.Crypt
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Kryptik.GKEA!tr.ransom
AVGWin32:Malware-gen
Paloaltogeneric.ml

How to remove Win32/Kryptik.GIND?

Win32/Kryptik.GIND removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

Leave a Comment