About “Win32/Kryptik.GLXU” infection

The Win32/Kryptik.GLXU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Kryptik.GLXU virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Dynamic (imported) function loading detected
• Creates RWX memory
• A process created a hidden window
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
• Exhibits behavior characteristic of Nymaim malware
• Collects information to fingerprint the system

How to determine Win32/Kryptik.GLXU?

File Info:
name: 30565A1787F296884DC5.mlw
path: /opt/CAPEv2/storage/binaries/f5a9f1786b8b872bf29c5b50541262f7a37400ba0999aa84036a1f5b960ab941
crc32: 06BC0A44
md5: 30565a1787f296884dc5418df11fbf1a
sha1: 220744e864e7202f080b4fe191633a9f149fca88
sha256: f5a9f1786b8b872bf29c5b50541262f7a37400ba0999aa84036a1f5b960ab941
sha512: cb5bb7c71a4d5899a303a29a726ef542ad05d758fb452973e61618873271201f11988ea1b39d13f5296a4b1f9c4ace218613389b48543a5db9481515e0b7875e
ssdeep: 24576:AP0omujVCJqzF4Y0EOdgRAYm5BGJXDUh2n6:AP0oRXz2SOdlY+BQT4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1F025237B1BD0F626F2821E35D50D79353F29E71F3603FE15A6E8888A882427B46D913C
sha3_384: 6752bf9522c906550b1f8d70d8771990b4f1a556ae7ae2ca4eac19601f1e8766c7555a2ccbe9f6af5b2334c69f5d9b88
ep_bytes: 31d25589e58d65bcb976980000b81b10
timestamp: 2012-09-05 15:05:50

Version Info:
0: [No Data]

Win32/Kryptik.GLXU also known as:

How to remove Win32/Kryptik.GLXU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.