Doina.11602 removal instruction

The Doina.11602 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.11602 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
A process attempted to delay the analysis task.
Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
A process created a hidden window
Performs some HTTP requests
Creates an autorun.inf file
Uses Windows utilities for basic functionality
Attempts to delete volume shadow copies
Attempts to repeatedly call a single API many times in order to delay analysis time
Modifies boot configuration settings
Creates a hidden or system file
Attempts to modify proxy settings
Clears Windows events or logs
Creates a copy of itself
Attempts to disable UAC
Attempts to modify UAC prompt behavior
Uses suspicious command line tools or Windows utilities

Related domains:

z.whorecord.xyz

a.tomx.xyz

ocsp.digicert.com

www.msftconnecttest.com

How to determine Doina.11602?


File Info:
crc32: 3CC3C624
md5: cc50c064994020c583371170de5a9c95
name: CC50C064994020C583371170DE5A9C95.mlw
sha1: 24e001da212b5895374c945761d3616914e1597f
sha256: dd369d72d50f8ea24e2d4c74abc49b2a020783e5712ae1d28cd20a4e87227463
sha512: c82d9b4578e4553878b0abd6ec1b4412232fa10e4069c31a36bc9d7cc8a1c46008033436dcc818a43c161af26ddc82b310bd4f7e5465d977d619e6e1618ee45c
ssdeep: 24576:H64PAlR0FxjnCXdNtYvFKmJpaBi7i2qbbbbpcny:acy0FxjnCXdbYvovBiWrbbbbpcn
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: taskhost.exe
FileVersion: 10.0.17763.831 (WinBuild.160101.0800)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 10.0.17763.831
FileDescription: Host Process for Windows Tasks
OriginalFilename: taskhost.exe
Translation: 0x0409 0x04b0

Doina.11602 also known as:

Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Doina.11602
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (W)
BitDefender	Gen:Variant.Doina.11602
Cybereason	malicious.499402
Symantec	Ransom.Avaddon!g1
ESET-NOD32	a variant of Win32/Filecoder.Avaddon.A
APEX	Malicious
Kaspersky	UDS:Trojan.Win32.DelShad.gen
MicroWorld-eScan	Gen:Variant.Doina.11602
Ad-Aware	Gen:Variant.Doina.11602
Sophos	ML/PE-A
BitDefenderTheta	Gen:NN.ZexaF.34688.av0@aeEdJAci
TrendMicro	Ransom.Win32.AVADDON.SMYJAF-A
McAfee-GW-Edition	BehavesLike.Win32.BadFile.th
FireEye	Generic.mg.cc50c064994020c5
Emsisoft	Gen:Variant.Doina.11602 (B)
Jiangmin	Trojan.Generic.gvrnd
Avira	HEUR/AGEN.1136765
eGambit	Unsafe.AI_Score_99%
Microsoft	Ransom:Win32/Avaddon.C!MTB
GData	Gen:Variant.Doina.11602
AhnLab-V3	Malware/Win32.RL_Generic.R341088
McAfee	Artemis!CC50C0649940
MAX	malware (ai score=82)
Malwarebytes	Ransom.Avaddon
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Ransom.Win32.AVADDON.SMYJAF-A
Rising	Malware.Heuristic!ET#99% (RDMK:cmRtazoRLAw1FzlfOy/B7apsMd+U)
Ikarus	Trojan-Ransom.Avaddon
Fortinet	W32/Avaddon.A!tr.ransom

How to remove Doina.11602?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Doina.11602 removal instruction