How to remove “Doina.17992”?

The Doina.17992 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Doina.17992 virus can do?

Creates RWX memory
Unconventionial binary language: Chinese (Simplified)
Anomalous binary characteristics

How to determine Doina.17992?


File Info:
crc32: 0DAF5FCC
md5: 0c6d85dd911cef67e8d696b194965a4b
name: 0C6D85DD911CEF67E8D696B194965A4B.mlw
sha1: baad6de398aa1fc72b8f14d25637a55944ccac69
sha256: 3b83cbf0cebeee10fcd6497eb28cf2933a65a2983bc42b4b3350fa65d72b7496
sha512: db40b650a977c1069fd7d994b54c0d2a7906a5b083b918169ca0d8b85e127be990310bfa661c5f0e1132441d4b69255c6797746ab2a2edc98e8219a1a56e58a3
ssdeep: 24576:GDv3hyBx11K8hU8KsCAx5ampOGt8SYiWdCMJ5Qxzr2C/hR:GDJ01sN2ampipiW0MbQxP
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x7248x6743x6240x6709 (C) 2010
InternalName: LoginTools.exe
FileVersion: 1,0,0,0
CompanyName: 178x7f51x6e38x5de5x4f5cx5ba4
ProductName: x5546x4e1ax7a0bx5e8f
ProductVersion: 1, 0, 0, 0
FileDescription: x5546x4e1ax7a0bx5e8f
OriginalFilename: LoginTools.exe
Translation: 0x0804 0x03a8

Doina.17992 also known as:

K7AntiVirus	Riskware ( 005439d61 )
Elastic	malicious (high confidence)
DrWeb	Trojan.DownLoader40.12935
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Doina.17992
Cylance	Unsafe
Zillya	Tool.GameTool.Win32.1172
CrowdStrike	win/malicious_confidence_60% (D)
K7GW	Riskware ( 005439d61 )
Cybereason	malicious.d911ce
Cyren	W32/Legendmir.S.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/RiskWare.GameTool.S
APEX	Malicious
Avast	Win32:Malware-gen
BitDefender	Gen:Variant.Doina.17992
NANO-Antivirus	Trojan.Win32.GameTool.ixmtuz
MicroWorld-eScan	Gen:Variant.Doina.17992
Tencent	Malware.Win32.Gencirc.10cf07c4
Ad-Aware	Gen:Variant.Doina.17992
Sophos	Generic ML PUA (PUA)
BitDefenderTheta	AI:Packer.C6B1A80219
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.PUPXFU.tm
FireEye	Generic.mg.0c6d85dd911cef67
Emsisoft	Gen:Variant.Doina.17992 (B)
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1103850
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	Trojan/Generic.ASMalwS.3343357
Arcabit	Trojan.Doina.D4648
GData	Gen:Variant.Doina.17992
AhnLab-V3	Unwanted/Win32.GameHack.R355518
McAfee	GenericRXGA-BH!0C6D85DD911C
MAX	malware (ai score=85)
VBA32	Trojan.SDP.27105
Malwarebytes	RiskWare.GameTool
Panda	Trj/Genetic.gen
Yandex	RiskWare.GameTool!dHta8m/b0EE
Ikarus	Trojan-Spy.Lmir
MaxSecure	Trojan.Malware.73613737.susgen
Fortinet	W32/Lmir.BQT!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove Doina.17992?

Doina.17992 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X