You ran Malwarebytes, it said the Kryptik trojan was removed, you rebooted, and it's back. That's maddening, but it's not Malwarebytes lying to you.
Why it keeps coming back (short version)
Kryptik almost never lives alone. It drops a loader — usually a scheduled task, a Run key, or a WMI subscription — that recreates the payload on boot faster than your antivirus can catch it. You remove the symptom, the dropper puts it back.
The fix is to kill the persistence first, then remove the payload. In that order. If you scan first, you'll be doing it again tomorrow.
The actual fix
Step 1: Disconnect from the network
Pull the Ethernet cable or turn off Wi-Fi. Kryptik variants often phone home to pull a fresh copy of themselves right after you remove the local file. Cut that off.
Step 2: Boot into Safe Mode with Networking off
Hold Shift while clicking Restart, then Troubleshoot → Advanced Options → Startup Settings → Restart. Pick Safe Mode (option 4). You need Safe Mode because half the persistence entries won't even show up in a normal session.
Step 3: Strip the persistence with Autoruns
Download Sysinternals Autoruns (autoruns64.exe) on a clean machine, copy it over on a USB stick. Run it as admin. Click Options → Hide Microsoft Entries, then hit Refresh. Now everything you see is a suspect.
Look in these tabs specifically:
- Scheduled Tasks — this is where 80% of Kryptik persistence hides. Look for tasks with random names like
KxLptfaOG, or tasks pointing to%AppData%\Roaming\or%LocalAppData%\Temp\. - Logon — Run and RunOnce keys under HKCU and HKLM. Anything pointing to a random-named exe in AppData is malware.
- Services — a fake service with a generic name like "Windows Update Helper" pointing to an exe in ProgramData.
- WMI — clever variants use __EventFilter + CommandLineEventConsumer to fire on every boot. Right-click and delete the entire subscription.
Uncheck the entries, reboot, confirm they stay gone. Then right-click and Delete them permanently.
Step 4: Find the payload
Open File Explorer and turn on hidden files plus protected OS files. Check these folders — Kryptik re-drops here constantly:
%AppData%\Roaming\
%LocalAppData%\
%LocalAppData%\Temp\
%ProgramData%\
C:\Users\Public\
Sort by Date Modified. Anything created in the last few days with a randomized name (8–12 characters, mixed case) is a strong candidate. Don't just delete — note the filename, because it'll tell you the persistence entry name too.
Step 5: Run a proper scan from Safe Mode
Now run Malwarebytes, then a second opinion scan with HitmanPro (it catches Kryptik variants Malwarebytes misses). Reboot still in Safe Mode before switching back to normal.
Step 6: If it STILL comes back — offlinescan
Some Kryptik variants patch the boot sector or inject into a legit signed binary. In that case, boot from a Windows install USB and run Defender Offline:
"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File C:\
Or burn a Kaspersky Rescue Disk to a USB and boot from it. It scans the filesystem without Windows running, which means the dropper can't fight back.
Why that order matters
Antivirus engines remove files. They're getting better at persistence, but a scheduled task that runs a PowerShell one-liner to re-download the payload doesn't look like a virus to most scanners — it looks like admin automation. So Malwarebytes removes the exe, you reboot, the task fires, and the exe returns before you've finished reading the "Threats Removed" popup.
Killing the persistence first means there's nothing to recreate the payload. Then scanning is a cleanup, not a whack-a-mole.
Less common variations
The WMI subscription variant
You won't see this in Task Scheduler or Autoruns unless you're looking at the WMI tab. To check manually, open PowerShell as admin and run:
Get-WmiObject -Namespace root\subscription -Class __EventFilter
Get-WmiObject -Namespace root\subscription -Class CommandLineEventConsumer
If you see filters with names like BVTConsumer or SCM Event Log Filter that aren't Microsoft-signed, delete both the consumer and the filter.
Browser extension dropper
A handful of Kryptik builds push a malicious Chrome/Edge extension that re-downloads the exe every time you open the browser. Check chrome://extensions and edge://extensions in Developer Mode. Any extension you don't recognize gets removed.
Shadow copy persistence
Rare but nasty: the trojan stores itself in a Volume Shadow Copy and restores from it. Clear them with:
vssadmin delete shadows /all /quiet
Only do this if you've already got a clean backup. Otherwise you're wiping your recovery points too.
Preventing round two
- Turn on Controlled Folder Access in Windows Security. It blocks unsigned processes from writing to AppData, which stops most droppers cold.
- Disable Office macros by default. Most Kryptik infections walk in through a .docm or .xlsm attachment.
- Use a standard (non-admin) user account for daily work. Half of these persist via HKLM keys that need admin to write.
- Keep a clean system image. If you get hit again, restoring from image is 20 minutes vs. an afternoon of cleaning.
If you've followed all of this and it's still reappearing, back up your data and reinstall Windows. I've seen Kryptik variants that rootkit the kernel — at that point, cleaning is a losing game.