Kryptik: what the trojan alert means and how to remove it
Kryptik is the word ESET, Avast and others put in the name of a detection for packed Windows trojans, and the file behind it can be anything from a password stealer to a false alarm. Identify the flagged file first, then scan from Safe Mode and with Microsoft Defender Offline.
Facts checked October 12, 2026. Removal steps tested on Windows 11 (26H2) and checked against Microsoft's and the browser makers' current documentation.
Automatic
Get a free scan and check if your PC is infected.
Fortect finds malware, unwanted programs and the Windows damage they leave behind, and repairs it in one pass.
Programs like an antivirus alert naming Kryptik, such as Win32/Kryptik or Win32:Kryptik usually arrive in groups; a free scan lists the companions that are easy to miss.
Do it yourself · free Remove Kryptik Trojan yourself 5 steps, about 15 minutes, no software needed.
Start the steps![A staged photo of a woman holding a laptop that shows a red Trojan horse blocked message from the Avast Web Shield naming the infection Win32:Kryptik-LSG [Trj] and the process iexplore.exe, with the title Kryptik Trojan](/pic/w1080q75/uploads/wp/virusai/kryptik-virus_en.jpg.webp)
Kryptik Trojan: summary
| Type | A detection label, mostly ESET's Win32/Kryptik and Avast's Win32:Kryptik, for packed or hidden Windows trojans; not one program |
|---|---|
| Risk | Depends on the file: from a false positive to a data stealer, backdoor or screen locker in the cases we read. Treat it as medium until the file is identified |
| Symptoms | Often only the antivirus alert. Microsoft lists slow performance, freezing, added files and changed settings; PCrisk adds a changed home page and a proxy |
| How to get rid of it | Safe Mode with Networking, a full scan, Microsoft Defender Offline, a startup check with Autoruns, Windows updates, System Restore; change passwords from another device if it was real |
| Our check (6 October 2026) | No PC test: we read Huntress, PCrisk, NJCCIC, Microsoft and four ESET forum cases; no sample was run |
| First seen | Around 2008 (Huntress); Win32/Kryptik.KGY dates from 2010 (ESET); our first guide 13 January 2021 |
| Removal | Scan the PC with security software to find and remove the malware and anything installed with it. Fortect scans Windows for malware and repairs the system files and settings it damaged. Remove it nowTo use the full-featured product, you have to purchase a license for Fortect. The scan is free. |
Show 7 more facts
| Detection | Microsoft: Trojan:Win32/Kryptik!ap. ESET: Win32/Kryptik.<letters>. Avast: Win32:Kryptik-<letters> [Trj] |
|---|---|
| Not to be confused with | Zbot (TR/PSW.Zbot, PWS:Win32/Zbot), a different password-stealing family that our 2021 list mixed in |
| Name | Kryptik Trojan |
| Evidence | 0 write-ups by security sites; details still limited |
| Distribution | Typically fake installers, cracked programs, e-mail attachments, fake "verify you are human" pages and ads for popular apps |
| Damage | Installs other malware, often several programs at once |
| Facts checked | 6 October 2026 |
Facts checked on 6 October 2026 against Huntress, PCrisk, the NJCCIC profile, Microsoft's Kryptik!ap entry, three ESET Security Forum threads from 2013, 2020 and 2026, and Microsoft Support pages. We ran no sample and tested no PC; the removal steps follow Microsoft's pages and were not tried on a live infection.
What Kryptik is, and what it is not
Kryptik is not one program you can find and uninstall. It is a word that security products put in the name of a detection, and the same word is used for many different files. Our 2021 guide described it as one trojan with one set of actions, and that was too neat.
- 1
What the security sources say
Huntress, a security company, calls Kryptik "not a single malware family but a generic, heuristic detection name", most commonly ESET's Win32/Kryptik, applied to heavily packed or obfuscated Windows trojans. It says the files can be different threats, such as stealers, backdoors, downloaders or ransomware loaders, that share only the trait of being hidden, and that some flagged files may be false positives.
- 2
What PCrisk says
PCrisk, a malware-removal site, says "Kryptik" (also Krypt, Cryptic, Crypt and Packed) is used by malware databases to describe packed, compressed files, and that the sample it examined, Win32/Kryptik.BGIS, is a backdoor trojan that can be controlled remotely.
- 3
What Microsoft says
Microsoft lists Trojan:Win32/Kryptik!ap, published 29 November 2022, and says Microsoft Defender Antivirus detects and removes it. The page says only that it can perform actions of a malicious actor's choice and that technical details are not available.
- 4
What our 2021 guide got wrong
It said Win32:Kryptik is a trojan that typically arrives through infected installers, asks for administrator rights, edits the registry and deletes its own file. No source we read says that about the label as a whole. It also listed old names such as Zbot, which is a different, older password-stealing family, as if they were aliases of Kryptik.
- Is it a file name?
- No: it is a detection label that goes into names such as Win32/Kryptik.BGIS
- Mostly shown by
- ESET as Win32/Kryptik.<letters>; Avast writes Win32:Kryptik-<letters> [Trj], as in our 2021 picture; Microsoft uses Trojan:Win32/Kryptik!ap
- Platform
- Windows (Win32 in the name); PCrisk's own sample was a JavaScript file named JS/Kryptik.AOW
- What the letters mean
- A variant code, such as BGIS, KGY, HZEJ or BOJT. We found no vendor page that explains them, so treat them only as an identifier to look up
- First seen
- Huntress says around 2008; an ESET staff member wrote in 2020 that Win32/Kryptik.KGY was a detection from 2010
So the question to answer is not how to remove Kryptik. It is whether the file your product flagged is really harmful, and if it is, what that file does. The next chapters help you tell.
What Grayware/Win32.Kryptik.pe means and how it differs from Win32/Kryptik
Grayware/Win32.Kryptik.pe is a detection name that puts the Kryptik label under a grayware category instead of a trojan category.
Antiy, whose AVL SDK engine is built into other security products and online scanners, uses names that start with GrayWare/Win32 for unwanted software. It describes that category as programs that get onto a computer through deceptive means and add things like advertising plug-ins and browser toolbars.
We found no reliable source that describes the exact variant Kryptik.pe. Our reading is that the scanner saw a packed Windows file, the Kryptik part, and rated its behaviour as unwanted rather than clearly malicious, the Grayware part.
The letters at the end mark one variant and tell you nothing about what the file does. So the alert can point to bundled adware, a tool you meant to install, or a false alarm.
Treat it the way this guide treats any Kryptik alert. Note the full path of the flagged file, check where it came from and whether it is signed, and upload it to a multi-engine scanner to see what other vendors call it.
If Microsoft Defender or a second engine also flags it, remove it with the steps above. If only one engine flags a file from a trusted publisher, report it as a possible false positive.
What Kryptik Trojan does on an infected PC
One file, many names: the list from our 2021 guide
The 2021 guide gave one line of names. Several of them are not Kryptik at all, and that is how a single file can show up with a different label in each product.
| Name in our 2021 guide | What it looks like | What it tells you |
|---|---|---|
| Win32/Kryptik.BGIS | ESET's pattern, Win32/Family.Variant. PCrisk uses this name for a backdoor trojan | The ESET name for the sample PCrisk wrote about; it is a variant, not the label as a whole |
| Win32:Kryptik, Win32:Kryptik-LSG, Win32:Kryptik-FOR | Avast's style, with a colon and [Trj] at the end, as in our 2021 picture | A different engine calling a file Kryptik. The 2021 picture shows the alert name Win32:Kryptik-LSG [Trj] |
| Win32/Kryptik.KGY | ESET | Marcos from ESET wrote in 2020 that it was a detection from 2010. A reader got it on an Adobe Flash installer in June 2020 |
| TR/PSW.Zbot.AM.17741 | A TR/ prefix, which reads like Avira's scheme (our reading, we did not check it) | Zbot is another family, a password stealer. This name is not Kryptik |
| Trojan-Spy.Win32.Zbot.nsfm | Reads like Kaspersky's scheme (our reading) | Again Zbot, not Kryptik |
| PWS:Win32/Zbot.gen!AM | Microsoft's pattern | Microsoft's name for a password stealer from the Zbot family, not for Kryptik |
| Trojan.GenericKD.1130356 | A generic name followed by a signature number | A catch-all label from a Bitdefender-style engine, not a family |
Two engines giving one file two names is normal, and does not mean there are two infections. Two names that look unrelated, such as Kryptik and Zbot, mean only that the engines disagreed about what the file is, which is exactly what a packed file does to a scanner.
What we checked on 6 October 2026, and what we could not
There is no website here to test and we ran no sample, so this is a reading of sources, not a test of a PC. We read the security pages, Microsoft's entry and four public forum cases.
Our reading of the sources, 6 October 2026
- The label existsESET's Win32/Kryptik, Avast's Win32:Kryptik and Microsoft's Trojan:Win32/Kryptik!ap are real detection names, so the alert is not a scam page.
- What one Kryptik file doesNot the same in any two cases we read: a screen locker in 2013, a file that reads saved FTP logins, a JavaScript downloader, a backdoor. The label alone does not say.
- Real or false positiveBoth happen. In January 2026 ESET called a Win32/Kryptik.HZEJ detection on Visual Studio Code installers a false positive and fixed it; in 2013 a Kryptik.BOJT file locked a PC and demanded money.
- How it got thereNot shown by the label. PCrisk lists email attachments, fake updaters, cracks and malicious ads for its sample; no source ties every Kryptik file to one route.
- A second tool finding nothingDoes not clear it. In the June 2020 case ESET alone raised the alarm, a scan of the file at VirusTotal found nothing and a later full scan found nothing, and the question was never settled.
Treat it as real until the file is identified This reading is one look at public cases, not a test of your PC. Packed malware hides from some scans, so a quiet second scan is one more data point, not an all-clear. Follow the check and removal chapters, and keep banking off the PC until you know.
How Kryptik showed up from 2008 to 2026
Our guide dates from 13 January 2021. The picture at the top is from it; the other entries are public reports.
About 2008
The label appears
Huntress says Kryptik first emerged in the wild around 2008. An ESET staff member wrote in June 2020 that Win32/Kryptik.KGY, one variant, was a detection from 2010.
November 2013
A locked PC and a $300 demand
A reader on the ESET forum said a Win32/Kryptik.BOJT file locked the PC and asked $300 for a key. ESET's product quarantined it on the third restart. A forum helper spotted a service entry named Windows Management Instrumentation that pointed to a file with an odd name in the ProgramData folder, and said it was most likely related to the infection.
June 2020
A Flash installer, no file to find
A reader got Win32/Kryptik.KGY while running an Adobe Flash Player installer. ESET showed it as a memory detection, so scanning the installer file found nothing. A forum helper thought the existing Flash files may have been infected; others suggested a false positive. The same file scored zero detections at VirusTotal, and a later full scan found nothing.
13 January 2021
Our first guide
The 2021 guide treated Kryptik as one trojan that steals data and damages the PC, and showed an Avast alert naming Win32:Kryptik-LSG [Trj].
29 November 2022
Microsoft publishes its entry
Microsoft's Trojan:Win32/Kryptik!ap page was published, with the note that technical details are not available.
30 January 2026
A false positive on code editor installers
A reader reported Win32/Kryptik.HZEJ on Visual Studio Code installers. ESET was the only vendor on VirusTotal to flag them. ESET staff replied the next day that it was a false positive, fixed the day before, and that the files were restored from quarantine automatically.
Same label, different jobs: what Kryptik files have done
No two cases we found matched. Read the table to see how wide the label is, and look for the row that fits what you see.
| Case | What the file did or was | Source |
|---|---|---|
| Win32/Kryptik.BOJT, 2013 | Locked the computer and demanded $300. The reader also said the trojan photographed the user, which no one confirmed | ESET Security Forum |
| A Kryptik trojan profiled by New Jersey's cyber centre (NJCCIC) | Queries the Windows registry for the paths and saved host, user name and password of FTP clients, and can recover many FTP, email and file-manager programs. It can update itself and download new versions | NJCCIC |
| Win32/Kryptik.BGIS, PCrisk | A backdoor trojan said to steal email addresses, clipboard data, program logins and certificates, to log keystrokes, take screenshots, change the home page and set up a proxy server | PCrisk |
| JS/Kryptik.AOW, PCrisk's sample | A JavaScript file, labelled by Kaspersky as Trojan-Downloader.JS.Iframe.dfe and by Avira as JS/Quidvetis.A | PCrisk |
| Win32/Kryptik.KGY, 2020 | Seen as a memory detection while an Adobe Flash installer ran; no file was found afterwards | ESET Security Forum |
| Win32/Kryptik.HZEJ, 2026 | A false positive on Visual Studio Code installers, fixed by ESET | ESET Security Forum |
This is why our 2021 line that Kryptik deletes its own executable, takes administrator rights and writes registry entries is not repeated here as a fact about the label. It may be true of one file, and the check below is how you find out which kind you have.
What Kryptik Trojan can steal or download
What a Kryptik file can cost you
The risks below come from the cases above and from the 2021 guide. They are possibilities for a real Kryptik file, not findings about every alert.
- High
Stolen logins and personal data
PCrisk and the NJCCIC profile describe Kryptik files that collect saved logins, FTP and email program details, and clipboard data. The 2021 guide said the same of the family it described and added that this can lead to stolen money or identity theft.
- High
Remote control of the PC
PCrisk calls the sample it studied a backdoor that can be controlled remotely, and says it can run programs, take screenshots and restart the PC. Our 2021 guide said hackers could take full control.
- High
Locking the PC for money
The 2013 BOJT case locked the PC and demanded $300. It is one case, but it shows the label can sit on a locker.
- Medium
More malware
The NJCCIC profile says the trojan can update itself and remotely download new versions, and PCrisk's sample was labelled a downloader. Our 2021 guide said it keeps trying to fetch more malicious files, which also slows the connection.
- Medium
Changed browser and proxy settings
PCrisk says it can change the home page, set up a proxy server and block some websites. That would send your traffic through someone else's server, and, as the 2021 guide put it, put ads in front of you and push you to harmful sites.
- Medium
A slow or unstable PC
Microsoft's entry lists slow performance, freezing or crashing, added or modified files and less free space as symptoms. They are not proof of Kryptik, but they are a reason to scan.
- Low
Nothing at all
A false positive does no harm. The ESET HZEJ detections on code editor installers in January 2026 were fixed by ESET and the files restored from quarantine.
What you may notice, and what the sources show
The 2021 guide listed crashes, restarts, a busy processor, ads on every page and a slow connection. The sources tie some of them to a Kryptik file and others to nothing in particular, and they say plainly that trojans are often silent.
| Sign | What we found |
|---|---|
| The alert itself | In every case we read it was the first and sometimes only sign, from ESET, Avast or another engine |
| Slow PC, programs freezing or crashing | Microsoft lists slow performance and freezing or crashing for Trojan:Win32/Kryptik!ap. Many other problems cause the same, so it is not proof |
| High CPU use, or the PC restarting by itself | Our 2021 guide listed them. No source we read ties them to Kryptik in particular |
| Added or modified files, less free space | Both in Microsoft's list. In 2013 a forum helper found a file with an odd name in ProgramData and a service pointing to it |
| Changed home page or proxy, ads on every site | PCrisk lists a changed home page and a proxy server for its sample. Check Settings, Network and internet, Proxy |
| Slow connection | Our 2021 guide linked it to the trojan fetching files. A slow connection has many causes, so it is a reason to check, not a diagnosis |
| Files with the .sol extension deleted | From our 2021 guide. We found no source for it and did not repeat it as a sign |
| Nothing at all | PCrisk says trojans are built to stay silent, so no symptoms is normal |
What data a Kryptik file may collect
The 2021 guide listed four kinds of data. PCrisk's page and the NJCCIC profile add more, but each belongs to a particular file, so read them as a list of what is possible.
Listed in our 2021 guide
- Digital certificates and their passwords
- User name and computer name
- Logins and passwords of certain programs and services
- Email account details, including Outlook
These match what PCrisk describes for its sample.
Added by PCrisk and the NJCCIC profile
- Clipboard contents
- Addresses of pages you visit
- POP3 and IMAP account information
- Operating system version
- Saved FTP host, user name and password
- Screenshots and keystrokes
Screenshots and keystroke logging are listed by PCrisk as things its sample can do. The 2021 guide said the data is sent out over an encrypted channel using RC4; we found no source for that, so we did not keep it.
How to check the PC for Kryptik Trojan
How a Kryptik file gets onto a PC
The label does not say how a file arrived, and PCrisk says it is not known exactly how its sample spread. These are the routes the sources and our 2021 guide list.
- 1
A malicious installer
Our 2021 guide called this the most prevalent route: an installer from a hacked or booby-trapped site, a repacked or illegal copy of a program, a keygen or a codec. PCrisk lists fake software updaters and unofficial activation tools, which it calls cracks.
- 2
A spam attachment
PCrisk lists Office documents, ZIP and RAR archives, PDF files, EXE files and JavaScript files attached to email. Huntress says phishing with attachments is one of the routes for Kryptik-labelled files.
- 3
Malicious ads and drive-by pages
PCrisk lists malicious online advertisements and Huntress lists drive-by downloads and exploit kits for unpatched software, which our 2021 guide called a site injected with malicious code.
- 4
File sharing and social media links
Our 2021 guide listed file-sharing sites, peer-to-peer clients and links on social media. PCrisk adds free file hosting and freeware download pages.
- 5
A trusted file that is not what it seems
The June 2020 Flash case shows a normal installer can set off the alert because the match was in memory while it ran. That can be a false positive, or something already on the PC.
Often the only sign of the first infection is the antivirus alert, so write down what you did in the minutes before it appeared.
Check the alert before you delete anything
Write down exactly what the alert says before you click Delete or Clean. The vendor, the full name, the file path and the time are what you need to tell a real infection from a false alarm.
- 1
Copy the alert
Take a photo or screenshot. Note which product raised it (ESET, Avast, Windows Security or another), the full name including the letters, the file or process it names and the time.
- 2
Ask what you were doing
A fresh download, an email attachment, a crack or a software update just before the alert is the most likely route. In the 2026 HZEJ case the files were Visual Studio Code installers started by an update.
- 3
Look at the file's path
A program installer in your Downloads or Temp folder is different from a file with an odd name in
C:\ProgramDataor a Windows system folder. In 2013 a forum helper found a service entry called Windows Management Instrumentation that pointed to an oddly named file in ProgramData and judged it part of the infection. - 4
Check the file's hash at VirusTotal
If you can still find the file, upload it or search its hash on VirusTotal. If only one vendor flags it, as ESET alone did for the HZEJ installers, it may be a false positive. If many do, it is real. A zero is not a clearance for packed files.
- 5
Look at what starts with Windows
Press Ctrl + Shift + Esc, open Startup apps and note names you do not know. Microsoft's Autoruns from Sysinternals shows more places, including the Run keys, services and scheduled tasks.
- 6
Check your proxy
Open Settings > Network & internet > Proxy. If Use a proxy server is on and you did not set it, turn it off; PCrisk says its sample can set up a proxy server.
- 7
Check for a second antivirus
Open Settings > Apps > Installed apps and look for more than one security product with live protection. Two of them can raise alerts about each other.
How to remove Kryptik Trojan
A loader's job is to install other malware, so treat the PC as infected with more than one program until the scans are clean.
Step 1: Delete scheduled tasks that bring it back
Programs like Kryptik Trojan add a scheduled task so they return after an uninstall or reopen a page at every sign-in. Start Task Scheduler, open Task Scheduler Library and sort by Last Run Time to see what ran recently.
On the Actions tab, a program in a user folder, a script or a web address is a warning sign; right-click such a task and choose Delete.
Tasks with names copying Google, Edge or Windows updaters but pointing to an odd folder are typical. The tool looks the same in Windows 11 and Windows 10.
Windows 11: Task Scheduler Library, the task selected, the Actions tab shows the file it runs. Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 2: Remove it from startup
Press Ctrl + Shift + Esc to open Task Manager and select Startup apps (Windows 11) or the Startup tab (Windows 10). Disable entries you do not recognise, especially ones with no publisher or with a name that copies a Windows component.
Right-click an entry and choose Open file location to see where it runs from: programs in
%AppData%or%Temp%deserve a closer look. Some entries are not listed there but in the registry Run keys, which the procedure below shows how to check.Full procedure with screenshots: Stop apps from opening at startup On uGetFix
Step 3: Delete the folders left behind
Uninstalling often leaves the program's folders, and some threats reinstall themselves from them.
Press Windows + R, type
%LocalAppData%and press Enter, then do the same for%AppData%and %ProgramData%, and look for folders named after Kryptik Trojan, its publisher or created on the day the problem started.Delete those folders, and check
C:\Program FilesandC:\Program Files (x86)too.If Windows says a file is in use, end it in Task Manager or delete the folder after a restart in Safe Mode. The folders are the same in Windows 11 and Windows 10.
Full procedure with screenshots: Remove what malware leaves behind in Windows
Step 4: Scan the PC, then run the offline scan
A scan finds the parts of Kryptik Trojan that the manual steps cannot see. In Windows Security > Virus & threat protection > Scan options, start a Full scan and quarantine what it reports.
Follow it with Microsoft Defender Antivirus (offline scan) > Scan now, which restarts the PC and checks the disk while Windows and the malware are not running.
It takes about 15 minutes and works the same in Windows 11 and Windows 10. If either scan finds something, run the full scan again after removal until it comes back clean.
Windows 11: Windows Security > Virus & threat protection > Scan options. Full procedure with screenshots: Run a Microsoft Defender Offline scan
Step 5: Change passwords from another device and sign out other sessions
Kryptik Trojan can copy saved passwords, cookies and session tokens and send them out in seconds, so cleaning the PC does not undo the theft.
Change your passwords on a device that was never infected, starting with the e-mail account, since every other reset goes through it. On each account, end all other sessions and check the recovery e-mail, phone number and forwarding rules.
Then turn on two-step verification. Sign in on the Windows 11 or Windows 10 PC again only after the offline scan is clean.
Full procedure with screenshots: Turn on two-step verification / secure a hacked account
Remove it from Windows 11 and Windows 10
Do the steps in order and stop when a scan from outside Windows is clean and the alert has not returned. We did not run these steps against a live infection; they follow Microsoft's pages and the way the cases we read were solved.
- 1
Disconnect, then back up documents
Turn off Wi-Fi or unplug the cable so a trojan cannot send data or fetch more files. Copy documents and photos, not programs, to an external drive that you unplug afterwards.
- 2
Start in Safe Mode with Networking
Our 2021 guide asked for this, and Microsoft says Safe Mode starts Windows in a limited state with only the bare essential services and drivers. Open Settings > System > Recovery, click Restart now next to Advanced startup, then choose Troubleshoot > Advanced options > Startup Settings > Restart and press 5 or F5 for Safe Mode with Networking.
- 3
Run a full scan
In Safe Mode open Windows Security > Virus & threat protection > Scan options, choose Full scan and click Scan now. Microsoft says a full scan covers every file and program on the device. If you use another security product, start it by hand and run its full scan too.
- 4
Run Microsoft Defender Offline
In Windows Security > Virus & threat protection > Scan options choose Microsoft Defender Offline scan and Scan now. Microsoft says it restarts the PC and scans before Windows loads, so persistent malware has a harder time hiding, and that it takes about 15 minutes. See the result under Protection history.
- 5
Remove what you can name
Open Autoruns, which shows what runs at startup, and uncheck an entry to disable it before you delete it. Only touch an entry that points to the file your alert named or to a file in an odd place. Do not delete registry keys or Windows files you cannot identify.
- 6
Reset the proxy and the browser
Open Settings > Network & internet > Proxy and turn off a proxy you did not set. Then check the home page and extensions in each browser.
- 7
Update Windows
Open Settings > Windows Update and install everything offered. Several of the routes above use known holes in unpatched software.
- 8
Try System Restore
If the alert began after a recent install, press Windows logo + R, type
rstrui.exeand choose a restore point from before it. Microsoft says System Restore changes system files, registry settings and installed programs, and leaves personal files alone. It will not help if no restore point exists. - 9
Last resort: reset Windows
Back up documents, then use Settings > System > Recovery > Reset this PC and choose Remove everything, or reinstall from a USB installer. Restore documents only, never a full system image.
Our 2021 guide said not to remove it manually, because it can damage system files. Scans, Safe Mode and disabling a startup entry you can identify are safe for any reader. Deleting registry keys or Windows files is where damage happens, and that part is best left to a scanner or to an expert. Never download a removal program because a pop-up tells you to.
Could it be a false alarm?
Yes. ESET confirmed one in January 2026 for Win32/Kryptik.HZEJ. These signs point each way, and only the vendor can confirm a false positive.
| Points to a real infection | Points to a false positive |
|---|---|
| The alert names a file in ProgramData, Temp or a system folder with an odd name | The alert names a known program installer or updater from its maker |
| Several vendors on VirusTotal flag the file | Only one vendor flags it, as with the HZEJ installers in 2026 |
| The alert returns after a clean-up or restart | It appeared once and the product removed it |
| The PC acts differently: locked screen, odd proxy, new startup items | The PC works normally and only the alert is odd |
| You opened a crack, a fake update or an attachment just before | You ran a normal update of software you trust |
If you think it is a false positive, send the file to the vendor: ESET fixed HZEJ within a day of the report and restored the quarantined files. Do not exclude a file from scanning unless the maker of the program confirms it is safe.
After removal: passwords, accounts and prevention
Secure your accounts after the clean-up
Assume that whatever was saved in the browsers on this PC while the PC showed an antivirus alert naming Kryptik, such as Win32/Kryptik or Win32:Kryptik in the list of installed apps has been copied:
- passwords
- cookies
- autofill data
Work from a clean device, or from this PC once the offline scan finds nothing.
Start with your main e-mail account, because it can reset everything else, then banking and payment, then social and gaming accounts. Change each password, sign out of all sessions and turn on two-step verification: Turn on two-step verification / secure a hacked account.
The full order, including crypto wallets and card replacement, is in securing your accounts after malware.
If it was real: what to do about your accounts
The scans deal with the PC. These steps deal with what the trojan could have seen. Our 2021 guide said it plainly: this kind of data can lead to stolen money or identity theft.
- 1
Change passwords from another device
Email first, then banking, then everything else. Turn on two-step sign-in. Do this before you use banking on the infected PC.
- 2
Replace saved logins
If a program stored an FTP, email or website password, change it at the service, because the NJCCIC profile says Kryptik variants read those from the registry.
- 3
Sign out everywhere
Use the sign out of all sessions option in your Google, Microsoft and social accounts so stolen cookies stop working.
- 4
Check your money
Look at card statements and wallets for payments you did not make.
- 5
Scan again in a week
A clean scan today does not clear packed malware. Run another full scan and a Defender Offline scan a week later and keep the alert screenshot.
Keep trojans off your PC
The 2021 advice still holds. Here it is with current details.
Do
- Keep one security product with Real-time protection on. Microsoft Defender is built into Windows 11 and 10.
- Download programs from their makers' sites or the Microsoft Store, and update through the program's own updater.
- Open attachments only when you expected them and the sender's address matches. Delete the rest.
- Install Windows Update monthly, and update browsers and PDF readers.
- Keep a backup of documents on a disk you unplug (File History or OneDrive).
- Use a password manager and two-step sign-in so one stolen password does not open every account.
Don't
- Do not run cracks, keygens, repacked installers or fake update prompts.
- Do not use file-sharing sites or peer-to-peer clients for software.
- Do not run two antivirus programs with live protection at once.
- Do not trust a download link in a social media post.
Questions about Kryptik Trojan
What is Kryptik?
Kryptik is a detection name that security products give to packed or obfuscated Windows trojans, not a single program. Huntress calls it a generic, heuristic detection, most commonly ESET's Win32/Kryptik, and says the files behind it can be stealers, backdoors, downloaders or ransomware loaders.
PCrisk says Kryptik is also used for packed files in general. The letters after it, such as BGIS or KGY, identify a variant.
In the cases we read, one Kryptik file locked a PC for money, another read FTP logins, and another was a false alarm on a code editor installer. So the name tells you the file is hidden, not what it does. Identify the file first.
Is Kryptik a virus, and is it dangerous?
Kryptik is a trojan label, and it can be dangerous or harmless depending on the file. A real Kryptik trojan can steal logins, record what you type, give an attacker remote control or download more malware, according to PCrisk and New Jersey's cyber centre (NJCCIC). A 2013 case locked the PC and asked for $300.
But ESET called its Kryptik.HZEJ detection on code editor installers a false positive in January 2026. Treat an alert as real until a scan from Safe Mode and Microsoft Defender Offline is clean and you have identified the flagged file. Keep banking off the PC until then.
What is the difference between Win32/Kryptik, Win32:Kryptik and Trojan:Win32/Kryptik!ap?
They are the same word in three vendors' naming styles. Win32/Kryptik.<letters> is ESET's, Win32:Kryptik-<letters> [Trj] is how Avast wrote it in our 2021 picture, and Trojan:Win32/Kryptik!ap is Microsoft's entry, published on 29 November 2022. They do not name the same file.
Each product applies its own signatures, so one file can carry one name in ESET, another in Avast and none at all in a third. Names like Zbot in our 2021 list are different families, not Kryptik aliases. Write down the vendor and the full name, because support teams need both.
Can Kryptik be a false positive?
Yes, it can. In January 2026 a reader reported Win32/Kryptik.HZEJ on Visual Studio Code installers. ESET was the only vendor flagging them at VirusTotal, and an ESET staff member replied that it was a false positive, fixed the day before, with the files restored from quarantine.
In June 2020 another reader got Win32/Kryptik.KGY while updating Adobe Flash Player; no one proved whether it was real, and the file scored no detections at VirusTotal. Check the file's path, what you ran and whether only one vendor flags it, then send the file to the vendor. Only the vendor can confirm.
How do I remove Kryptik from Windows 11 or 10?
Disconnect from the internet, back up documents, then start in Safe Mode with Networking and run a full scan in Windows Security. Next run a Microsoft Defender Offline scan, which Microsoft says restarts the PC and scans before Windows loads.
Check startup items with Autoruns, turn off a proxy you did not set, install all Windows updates and, if the alert began after an install, try System Restore.
Reset Windows only as a last resort. Do not delete registry keys or Windows files you cannot identify. We did not test these steps against a live infection; they follow Microsoft's pages.
Does Kryptik steal passwords?
Some Kryptik files do, but the label does not guarantee it. PCrisk says the sample it studied can collect email addresses, clipboard data, program logins, digital certificates and keystrokes, and New Jersey's cyber centre (NJCCIC) profile says one Kryptik trojan reads saved FTP, email and file-manager logins from the registry.
Our 2021 guide listed certificates, user names and Outlook details too. Another case in 2013 was a screen locker, and a third was a false alarm. If the detection was real, change your passwords from another device, sign out of every session and check your statements.
How did Kryptik get on my PC?
The label does not say, and PCrisk writes that it is not known exactly how its sample spread. The routes listed by PCrisk, Huntress and our 2021 guide are malicious installers and fake updaters, cracks and keygens, spam attachments, malicious ads, drive-by downloads on unpatched software, file-sharing sites and social media links.
Think about what you ran in the minutes before the alert, because it is often the only sign of the first infection. If the alert named a known program installer, a false positive is also possible.
My antivirus removed Kryptik. Am I safe?
Probably, but check, because a removed file may not be the whole infection. In a June 2020 ESET case, a full scan afterwards found nothing and a forum helper said the threat looked removed unless more detections or odd behaviour followed.
Packed malware can hide from some scans, so a clean scan is not a guarantee. Look at the product's detection log for what it deleted, run Microsoft Defender Offline, check startup items and the proxy setting, and scan again in a week. If the alert returns, treat it as real.
Can I remove Kryptik manually?
You can do the safe part yourself, but not the risky part. Our 2021 guide warned against manual removal because it can damage system files, and that holds for deleting registry keys and Windows files.
What any reader can do is start in Safe Mode, run full and offline scans, disable a startup entry that you can tie to the alert with Autoruns and turn off a proxy you did not set. If the infection survives that, back up documents and reset Windows. Never download a removal tool because a pop-up asks you to.
Will Fortect remove Kryptik Trojan?
Fortect scans Windows for malware and unwanted programs and repairs the system files and settings they change, and its free scan shows what it finds on your PC before you decide anything.
For Kryptik Trojan, follow the plan above as well: the browser steps take back permissions and settings that no scanner treats as a threat, and uninstalling the program that brought it removes the source.
Run Microsoft Defender's full scan and, if anything was found, its offline scan as a second opinion. If the symptoms are gone after the plan and both scans are clean, there is nothing more to do.
Sources
- Huntress Threat Library: Kryptik Malware (2025) (read October 6, 2026)
- PCrisk: Kryptik Trojan (updated June 2025) (read October 6, 2026)
- NJCCIC: Kryptik threat profile (read October 6, 2026)
- Microsoft Security Intelligence: Trojan:Win32/Kryptik!ap (read October 6, 2026)
- ESET Security Forum: Win32/Kryptik.BOJT Trojan variant found (November 2013) (read October 6, 2026)
- ESET Security Forum: Latest Adobe Flash update flagged with Win32/Kryptik.KGY (June 2020) (read October 6, 2026)
- ESET Security Forum: Possible False Positive Win32/Kryptik.HZEJ during VS Code update (January 2026) (read October 6, 2026)
- Microsoft Support: Windows startup settings (Safe Mode) (read October 6, 2026)
- Microsoft Support: System Restore (read October 6, 2026)
- Microsoft Learn: Microsoft Defender Offline scan in Windows (read October 6, 2026)
- Microsoft Support: Virus and threat protection in the Windows Security app (read October 6, 2026)
- Microsoft Support: Use a proxy server in Windows (read October 6, 2026)
- Microsoft Learn: Autoruns for Windows (Sysinternals) (read October 6, 2026)
- Antiy: AVL SDK Anti-Virus Engine Upgrade Announcement (25 November 2023) (read October 12, 2026)