Jump to content

CryptPKO.CryptPKO.1 and CryptSig.CryptSig.1 in Registry and Can't Delete


Recommended Posts

HKEY_CLASSES_ROOT\CryptPKO.CryptPKO.1   and    HKEY_CLASSES_ROOT\CryptSig.CryptSig.1 is in my Registry. I managed to delete the HKEY_CLASSES_\ROOT\CryptPKO.CryptPKO and the HKEY_CLASSES_ROOT\CryptSig.CryptSig from the Registry, but am unable to delete the first two. It is a Ransomware & Trojan where CryptPKO encrypts significant user files, demanding most likely financial compensation ransom from the victim.  I just found this a few days ago when I was going to delete an app out of the Registry after uninstalling it. I need help on permanently getting rid of out of my Registry.  

My desktop computer is running very slow when trying to sign on, and I've gotten a gray screen several times. Sometimes it takes up to 5 minutes to come on, and occasionally I have to Ctrl-Alt-Delete to sign on. Does Malwarebytes have a tool I can download to clean this and anything else out of my Registry? If so, please email it to me!

Thanks! Marcia

Edited by AdvancedSetup
Correct font issues
Link to post
Share on other sites

@MarciaD1224

Please do the following so that we may take a closer look at your system.

Please restart the computer and do the following.

WARNING: Do Not click the Repair option under Advanced unless requested by a Malwarebytes support agent or authorized helper

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to the Desktop or on the hidden Public desktop (usually C:\Users\Public\Desktop), please upload that file on your next reply

     

Thank you

Link to post
Share on other sites

  • Root Admin

Hello @MarciaD1224

The items you listed is not Ransomware. That is from Microsoft. Yes, it's possible that ransomware can and does use builtin encryption tools from Microsoft but it's not a threat.

 

HKEY_CLASSES_ROOT\CryptPKO.CryptPKO
HKEY_CLASSES_ROOT\CryptSig.CryptSig.1

CryptSig Class
{7444C719-39BF-11D1-8CD9-00C04FC29D45}


HKEY_CLASSES_ROOT\CLSID\{7444C719-39BF-11D1-8CD9-00C04FC29D45}

 

HKEY_CLASSES_ROOT\CLSID\{7444C719-39BF-11D1-8CD9-00C04FC29D45}
    (Default)    REG_SZ    CryptSig Class

HKEY_CLASSES_ROOT\CLSID\{7444C719-39BF-11D1-8CD9-00C04FC29D45}\InprocServer32
    (Default)    REG_EXPAND_SZ    %SystemRoot%\system32\cryptext.dll
    ThreadingModel    REG_SZ    Apartment

HKEY_CLASSES_ROOT\CLSID\{7444C719-39BF-11D1-8CD9-00C04FC29D45}\ProgID
    (Default)    REG_SZ    CryptSig.CryptSig.1

HKEY_CLASSES_ROOT\CLSID\{7444C719-39BF-11D1-8CD9-00C04FC29D45}\VersionIndependentProgID
    (Default)    REG_SZ    CryptSig.CryptSig

 

image.png

 

0/71 on VirusTotal

https://www.virustotal.com/gui/file/8e00b3acfd2d802acf577f5280b325f5befb6d8db17cf298aac3e1424d27d664?nocache=1

http://www.herdprotect.com/cryptext.dll-e1132144bc4a8c525fca3efe7ace4ee020de6a32.aspx

 

Please go ahead though and post back the requested logs and we can help you review the system and see if we're able to locate any issues.

 

Thank you

 

 

 

Link to post
Share on other sites

Here are the requested logs:  

  • HKEY_CLASSES_ROOT\CryptPKO.CryptPKO.1   and    HKEY_CLASSES_ROOT\CryptSig.CryptSig.1
 
  • Also, here's the website I found talking about the CryptPKO saying it's ransomware and a trojan.  Thank you for getting back with me so quickly!
  • Sincerely,
  • Marcia
  •  
  •  
https://sensorstechforum.com/cryptpko-description-and-removal/
Edited by AdvancedSetup
Disabled hyperlink
Link to post
Share on other sites

  • Root Admin

I don't see any log attachment.

As for the sensor tech forum - all I can say is that is false information

 

To begin, please do the following so that we may take a closer look at your installation for troubleshooting:

NOTE: The tools and the information obtained are safe and not harmful to your privacy or your computer, please allow the programs to run if blocked by your system.

  • Download the Malwarebytes Support Tool
  • In your Downloads folder, open the mb-support-x.x.x.xxx.exe file
  • In the User Account Control pop-up window, click Yes to continue the installation
  • Run the MBST Support Tool
  • In the left navigation pane of the Malwarebytes Support Tool, click Advanced
  • In the Advanced Options, click Gather Logs. A status diagram displays the tool is Getting logs from your machine
  • A zip file named mbst-grab-results.zip will be saved to the Public desktop, please upload that file on your next reply

Thank you

 

Link to post
Share on other sites

Here ya go... I'm sorry it took so long. I just signed in a few minutes ago, and my PC did an update earlier this morning. When I opened Brave, it showed all of my tabs across the top, but I had nothing but a "white screen" so I clicked on the Brave icon within the web page, and it finally opened up the pages on the tabs. I don't know what's going on with my desktop, but it's really beginning to tick me off!

Imbst-grab-results.zip

Link to post
Share on other sites

  • 3 weeks later...
  • Root Admin

Due to the lack of feedback, this topic is closed to prevent others from posting here.

If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this topic with your request.

This applies only to the originator of this topic. Other members who need assistance please start your own topic in a new thread.

Tips to help protect from infection

Thanks

 

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.