Win - Cryptor AVG detects this somewhat active Virus and its 4 known variants.

The most popular variants of Win - Cryptor are Win32 - Cryptor, Win32 - Cryptor.dropper, Win32 - Cryptor more ... Win32 - Cryptor.dropper

Statistics summary

Win - Cryptor is a Virus that is spreading. It is currently ranked 42 in the world for online threats. Win - Cryptor has been detected by AVG on victims' machines in 80 countries during the last month. There are currently 254 websites in 30 countries that host Win - Cryptor.

How can I remove Win - Cryptor?

AVG removes most issues caused by threats like Win - Cryptor during the regular scanning process.

Need technical support?

Free technical support is included with any paid AVG Anti-Virus product.

Get AVG Anti-Virus now!

or Download Free Trial

Rank this week

Rank last week

% of global detections

< 0.5%

THREAT DETECTIONS INDEX

Websites affected: 254
Host countries: 30
Victim countries: 80
Affected Operating Systems: All Windows OS

Show more about threat activity ↓ Show less about threat activity ↑

The results provided by this website are provided on an "as is" basis with no warranty as to accuracy or completeness. You acknowledge by using this website that you have read and agree to the terms and conditions available here.

Leave a comment about Win - Cryptor

comments powered by Disqus.

User Name: David Olson

Date: 2012-04-28T01:36:19

If AVGs clean doesn't get rid of it try the following, which seems to have worked for me. I make no warranty's of the safety to your system. 0. close active applications 1. kill the "rundll32.exe" processes (cryptor is a dll running in one of them) 2. delete all files in C:\Users\(your name)\AppData\Local\Temp (this is where the virus drops it's dll that was running, or will run next time you reboot) (2b. scan this Temp directory with AVG to be sure you removed it.) 3. Delete the "run next boot key" (may not not needed if the dll in Temp is gone):with regedit, at "[HKEY_USERS\S-1-5-21-84069xxxx-220425xxxx-398332xxxx-1001\Software\Microsoft\Windows\CurrentVersion\Run]" (or similar) DELETE a key that looks like: "qwisi"="rundll32.exe \"C:\\Users\\(your login)\\AppData\\Local\\Temp\\qwisi.dll\",DeletePage" (If you want to be safe, export this node before changing it so you can add it all back if necessary) Your dll may be a different name. the key is the "Temp" directory. Cryptor renames itself apparently: "preas.dll" "mgdrxr.dll" "qwisi.dll" and the description in File explorer one time said something legit like "Unzip utility" reboot and make sure no dll's showed up in your Temp directory.

User Name: Hotmale

Date: 2012-04-21T20:12:06

WHAT DOES IT DO!!! Come on people..

User Name: avgthreatlabs

Date: 2012-04-13T18:39:16

You may wish to contact <a href="http://www.avg.com/customer-support" rel="nofollow">www.avg.com/customer-support</a>

User Name: JB

Date: 2012-04-10T20:39:01

The regular scanning process for my AVG is not removing and healing this and has an "error" sign and says "threat removal" failed.

User Name: Jan Pivk

Date: 2012-03-20T16:51:34

What does it do?

Search for a Virus

Removal Video Guide

Support

FAQ: Finding answers to frequently asked questions
Free Forum: Search or submit a question to be answered by our experienced users.
Virus removal tools: Remove viruses using dedicated virus removal tools.
AVG Software updates: Download software updates and access our latest release notes.

Check File for Viruses

Is a file safe? Upload it and check it!

Upload a file…

Top Active Web Threats

Below are the most active threats detected on the web, ranked by percentage of total detections during the past 30 days.

1	Blackhole Exploit Kit	31.30%
2	Rogue Scanner	9.52%
3	Facebook Scam	7.92%
4	JavaScript Obfuscation	6.29%
5	Blackhole Exploit Kit Detection	5.40%
6	HTML - Framer	4.54%
7	Pharmacy Spam Site	3.17%
8	JS - Redir	2.76%
9	Generic	2.73%
10	Script - Exploit Kit	2.53%
11	JS - POPUP	2.38%
12	Phoenix exploit kit	1.92%
13	JS - Downloader	1.73%
14	Link to Exploit Site	1.19%
15	Downloader Agent	1.07%
16	Script Injection Redirect	1.15%
17	Win - DH	0.87%
18	Exploit	0.83%
19	JS - Agent	0.88%
20	Win - Heur	0.73%
21	Downloader Generic	0.66%
22	Dropper Generic	0.54%
23	JS - Obfuscated	0.45%
24	Script - Exploit	0.40%
25	Exploit_c	0.37%
26	JS - Downloader	0.37%
27	VBS - Heur	0.36%
28	JS - Psyme	0.38%
29	Blackhat SEO	0.26%
30	Generic_c	0.30%
31	FakeAlert	0.26%
32	JS - FakeCodec	0.30%
33	Generic_r	0.30%
34	SHeur	0.23%
35	Script - PDF	0.26%
36	Invisible IFrame Injection	0.27%
37	Cryptic	0.22%
38	Exploit	0.11%
39	PSW Generic	0.16%
40	Clicker	0.15%
41	Downloader NSIS	0.16%
42	Proxy	0.11%
43	IE Heap Memory Corruption	0.09%
44	MDAC ActiveX code execution	0.10%
45	Gondad Exploit Kit	0.23%
46	Win - Cryptor	0.13%
47	FakeAV	0.09%
48	Win - NSAnti	0.10%
49	JS - Tweet	0.09%
50	PSW Banker	0.08%
51	BackDoor Generic	0.09%
52	Downloader Banload	0.08%
53	Agent	0.08%
54	Invisible IFrame Launcher	0.06%
55	VBS - StartPage	0.07%
56	Downloader Generic_c	0.06%
57	Worm - AutoRun	0.06%
58	WebAttacker Exploit Kit	0.09%
59	Logger	0.05%
60	Mirar	0.05%
61	PHP - BackDoor	0.04%
62	JS - Generic	0.05%
63	Microsoft iepeers Exploit	0.02%
64	Agent_r	0.05%
65	JS - ClickJack	0.07%
66	Crypt	0.05%
67	JS - FBspam	0.06%
68	Script Injection	0.04%
69	Worm - Generic	0.04%
70	JS - Phish	0.05%
71	Hosts	0.04%
72	JS - Dropper	0.05%
73	Win - Zperm	0.03%
74	Worm - Small	0.03%
75	FakeAV_s	0.02%
76	Exploit	0.04%
77	HackTool	0.04%
78	PSW Agent	0.04%
79	BAT - Crypt	0.03%
80	Dropper Small	0.04%
81	Defiler	0.04%
82	Social Engineering	0.03%
83	Delf	0.03%
84	BackDoor Generic_s	0.02%
85	VB	0.03%
86	Rozena	0.03%
87	IRC - BackDoor SdBot	0.03%
88	IFrame Launcher Script	0.03%
89	Startpage	0.03%
90	Ransom	0.03%
91	Win - Delf	0.02%
92	Fat-Obfuscated	0.02%
93	Worm - Raleka	0.01%
94	Win - Vitru	0.02%
95	Win - Virut	0.02%
96	Toolbar	0.03%
97	Injector	0.02%
98	Java Exploit	0.00%
99	Downloader Adload	0.02%
100	BHO	0.02%

Follow us on Twitter: Get the latest feeds as they happen and take advantage of AVG discounts.
Join the Facebook community: Find out what’s new, get free advice & help protect your friends & familiy.
Subscribe to our YouTube channel: AVG TV: All the latest video news and product reviews.
Join us on LinkedIn: Find out what’s happening in the world of AVG business.