Doina.16391 removal instruction

The Doina.16391 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.16391 virus can do?

Attempts to connect to a dead IP:Port (1 unique times)
Presents an Authenticode digital signature
Starts servers listening on 127.0.0.1:0
A process created a hidden window
Drops a binary and executes it
Performs some HTTP requests
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Creates a hidden or system file
Detects VirtualBox through the presence of a registry key
Creates a copy of itself

Related domains:

note.youdao.com

ocsp.dcocsp.cn

How to determine Doina.16391?


File Info:
crc32: DE64C4A4
md5: 1d030cb5b777a2a18d04014eca255efc
name: 1D030CB5B777A2A18D04014ECA255EFC.mlw
sha1: 7b691e0fab01b6114c0a76561f41d3ec1b0f904c
sha256: f6f871429d45d38af619a57956be48c8e6eb3a71e8e1097174dbfd342815d42e
sha512: 54b870d235ef7aa48eb832a68388241352f6e32e559b44eaf9a6f68ea19728cc3c755cd3c595da8ce635ec4b76426348fb919bb765b5b501b367cef572816c75
ssdeep: 24576:u9s9VNjlLhcHgG9bIyD9PqN4jzKuXs1CAQx91j0I6484AuC:Gs9VNjlLhcHgUMynPUoFx91jj6545C
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: (C) 2019 Sogou.com Inc. All rights reserved.
InternalName: Launcher.exe
FileVersion: 3.3.0.30025
CompanyName: x641cx72d7x9ad8x901fx6d4fx89c8x5668
ProductName: x641cx72d7x9ad8x901fx6d4fx89c8x5668
ProductVersion: 3.3.0.30025
FileDescription: x641cx72d7x9ad8x901fx6d4fx89c8x5668 x4feex590dx7a0bx5e8f
OriginalFilename: Launcher.exe
Translation: 0x0804 0x04b0

Doina.16391 also known as:

Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Doina.16391
Cylance	Unsafe
Sangfor	Riskware.Win32.Wacapew.C
CrowdStrike	win/malicious_confidence_60% (W)
Alibaba	TrojanDownloader:Win32/Lotok.f83d156e
Cybereason	malicious.fab01b
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Agent.FSC
APEX	Malicious
Avast	Win32:MalwareX-gen [Trj]
Kaspersky	HEUR:Backdoor.Win32.Lotok.gen
BitDefender	Gen:Variant.Doina.16391
MicroWorld-eScan	Gen:Variant.Doina.16391
Ad-Aware	Gen:Variant.Doina.16391
Sophos	Generic PUA HL (PUA)
BitDefenderTheta	Gen:NN.ZexaF.34758.2u1@aaHrFmoj
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	Artemis!Trojan
FireEye	Gen:Variant.Doina.16391
Emsisoft	Gen:Variant.Doina.16391 (B)
eGambit	PE.Heur.InvalidSig
Microsoft	Trojan:Win32/Wacatac.B!ml
AegisLab	Trojan.Win32.Doina.4!c
GData	Gen:Variant.Doina.16391
McAfee	GenericRXOW-ZQ!1D030CB5B777
MAX	malware (ai score=81)
VBA32	BScope.Backdoor.Lotok
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002H09FH21
Ikarus	PUA.OpenSUpdater
Fortinet	Riskware/Lotok
AVG	Win32:MalwareX-gen [Trj]
Paloalto	generic.ml

How to remove Doina.16391?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Doina.16391 removal instruction