How to remove “Win32/Kryptik.HCFS”?

The Win32/Kryptik.HCFS is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Kryptik.HCFS virus can do?

Executable code extraction
Presents an Authenticode digital signature
Creates RWX memory
Attempts to repeatedly call a single API many times in order to delay analysis time
Network activity detected but not expressed in API logs

How to determine Win32/Kryptik.HCFS?


File Info:
crc32: F2440067
md5: bb73fafe97390f55a5d0182b1b2bd4ef
name: svr11.exe
sha1: a29612b5d4f324ea17eb7c9303bfb8b4202994c3
sha256: 8b35aa930dd7260060f12ff92f1447850fc1a6bd79a28ba05a2d4e54a3aad504
sha512: c7afacf515200ab87ef4aca279a20380b6e70361d54ac3bdda3e271b80e163a12079717b96cac58a2683f259ac2d2e759ee86a44db8de00b33cbc54d4b59a948
ssdeep: 24576:lhm8Dh1KrXsGJtDeZiSNA2tz/62fTsawDb3mtYek88EDK:eM8TR+Z79wXBD
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9 2000-2004 Hans Dietrich
FileVersion: 1, 2, 0, 1
ProductName: XBitArrayTest
E-mail: hdietrich2@hotmail.com
ProductVersion: 1, 2, 0, 1
FileDescription: XBitArrayTest.exe
OriginalFilename: XBitArrayTest.exe
Translation: 0x0409 0x04b0

Win32/Kryptik.HCFS also known as:

MicroWorld-eScan	Trojan.GenericKD.33706234
CAT-QuickHeal	Trojan.ArpRI.S12248937
McAfee	Artemis!BB73FAFE9739
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
BitDefender	Trojan.GenericKD.33706234
K7GW	Trojan ( 005634b51 )
CrowdStrike	win/malicious_confidence_60% (D)
TrendMicro	TrojanSpy.Win32.EMOTET.TIABOFIR
APEX	Malicious
Avast	Win32:BankerX-gen [Trj]
GData	Win32.Trojan.Kryptik.PVOQNK
Kaspersky	Trojan.Win32.Zenpak.zqp
Alibaba	Trojan:Win32/Emotet.94933a64
Rising	Trojan.MalCert!1.C466 (CLOUD)
Endgame	malicious (high confidence)
Emsisoft	MalCert.A (A)
F-Secure	Trojan.TR/AD.Swrort.ycwzw
DrWeb	Trojan.Encoder.31429
Invincea	heuristic
McAfee-GW-Edition	Artemis!Trojan
FireEye	Generic.mg.bb73fafe97390f55
Sophos	Mal/BadCert-Gen
Ikarus	Trojan.Win32.Crypt
Webroot	W32.Trojan.Gen
Avira	TR/AD.Swrort.ycwzw
MAX	malware (ai score=80)
Microsoft	Trojan:Win32/Emotet.BF!MTB
Arcabit	Trojan.Generic.D20250FA
ZoneAlarm	Trojan.Win32.Zenpak.zqp
AhnLab-V3	Malware/Win32.RL_Generic.R330046
Ad-Aware	Trojan.GenericKD.33706234
Malwarebytes	Trojan.Injector
ESET-NOD32	a variant of Win32/Kryptik.HCFS
TrendMicro-HouseCall	TrojanSpy.Win32.EMOTET.TIABOFIR
Fortinet	W32/Emotet.CD!tr
AVG	Win32:BankerX-gen [Trj]
Paloalto	generic.ml
Qihoo-360	Win32/Trojan.653

How to remove Win32/Kryptik.HCFS?

Win32/Kryptik.HCFS removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X