Categories: Malware

Doina.12533 removal guide

The Doina.12533 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.12533 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Dynamic (imported) function loading detected
Performs HTTP requests potentially not found in PCAP.
HTTPS urls from behavior.
Authenticode signature is invalid
Uses Windows utilities for basic functionality
Deletes its original binary from disk
Network activity contains more than one unique useragent.
Installs itself for autorun at Windows startup
Likely virus infection of existing system binary
Attempts to modify proxy settings
Harvests cookies for information gathering
Uses suspicious command line tools or Windows utilities

How to determine Doina.12533?


File Info:
name: 61F2B1894B7A7BEE9A11.mlwpath: /opt/CAPEv2/storage/binaries/a0faf43a9d2d69455107e57984007d24b21b022eb7573b5afc6b2db946414a5bcrc32: 5EEECFCFmd5: 61f2b1894b7a7bee9a11805018c1a856sha1: 52e37896aa384427f97fd205334c87fce128fa6asha256: a0faf43a9d2d69455107e57984007d24b21b022eb7573b5afc6b2db946414a5bsha512: 572a875978fa0d4fcde9d866ac2abbba61bc1c4f2956082a771b04e67482917de5b530f2f1bc38361f81eea89421f9fab85c15b9dd23cc1f66854e15f415684dssdeep: 6144:Xef88ZsSEfRr+I023GthmI6+QIiECzZo8Dss:Of88ZsSeRr+I0PXd6+b0T5type: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1BD54F226B0B31671EAC0DC3055B956629F7B2E3887CDC7E39B4805376AF00E3A57E261sha3_384: 7e1e63a58224a8bf8ba09ab90aab852349734d436fed5362b625f5c523569ffbedf9047114d0f4003a728fbf250bf899ep_bytes: 558bec6aff6808714000686043400064timestamp: 2012-03-01 09:19:58
Version Info:
0: [No Data]

Doina.12533 also known as:

Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Doina.12533
FireEye	Generic.mg.61f2b1894b7a7bee
CAT-QuickHeal	Backdoor.Kanav.MUE.AP3
ALYac	Gen:Variant.Doina.12533
Cylance	Unsafe
Sangfor	[ARMADILLO V1.71]
K7AntiVirus	Riskware ( 0040eff71 )
K7GW	Riskware ( 0040eff71 )
CrowdStrike	win/malicious_confidence_70% (D)
Baidu	Win32.Trojan-Downloader.Agent.bl
VirIT	Trojan.Win32.Generic.CGPT
Cyren	W32/Sadenav.D.gen!Eldorado
Symantec	Trojan Horse
ESET-NOD32	a variant of Win32/Alyak.E
APEX	Malicious
ClamAV	Win.Trojan.Agent-339112
Kaspersky	Trojan-Spy.Win32.Zbot.icyn
BitDefender	Gen:Variant.Doina.12533
NANO-Antivirus	Trojan.Win32.Clicker.wpsgp
Avast	Win32:Zbot-QIJ [Trj]
Tencent	Malware.Win32.Gencirc.10b71670
Ad-Aware	Gen:Variant.Doina.12533
Emsisoft	Gen:Variant.Doina.12533 (B)
Comodo	TrojWare.Win32.TrojanDownloader.Small.REK@4n2or7
F-Secure	Trojan.TR/Spy.Zbot.icyna
DrWeb	Trojan.Click2.16782
Zillya	Trojan.Jorik.Win32.60949
TrendMicro	BKDR_KANAV.AC
McAfee-GW-Edition	Generic BackDoor.xt
Sophos	Mal/EncPk-AJG
SentinelOne	Static AI – Malicious PE
GData	Gen:Variant.Doina.12533
Jiangmin	Trojan/Generic.xchx
Avira	TR/Spy.Zbot.icyna
MAX	malware (ai score=85)
Antiy-AVL	Trojan/Generic.ASMalwS.BCEED
ViRobot	Dropper.Agent.45056.V
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Dropper/Win32.OnlineGameHack.R21565
Acronis	suspicious
McAfee	Generic BackDoor.xt
VBA32	BScope.Trojan.Win32.Inject.2
TrendMicro-HouseCall	BKDR_KANAV.AC
Rising	Trojan.Generic@AI.100 (RDMK:cmRtazpQYwmetcmthiVt78GLmLx3)
Yandex	Trojan.GenAsa!tjLTCZR7jYs
Ikarus	Trojan.Win32.Alyak
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Dloader.RAK!tr
BitDefenderTheta	Gen:NN.ZexaF.34606.rmZ@aW2Ysud
AVG	Win32:Zbot-QIJ [Trj]
Cybereason	malicious.94b7a7
Panda	Generic Malware