Categories: Malware

Doina.18762 removal instruction

The Doina.18762 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.18762 virus can do?

Sample contains Overlay data
Reads data out of its own binary image
Unconventionial language used in binary resources: Chinese (Simplified)
Authenticode signature is invalid
Deletes executed files from disk
Created a service that was not started
Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Doina.18762?


File Info:
name: 0087BCE20ABAC0DBD98C.mlwpath: /opt/CAPEv2/storage/binaries/45b50ea789225c3d921263c1b0aaf38c3e6139fcff97a0bfb69f42829d3eaaedcrc32: F0CBAA32md5: 0087bce20abac0dbd98cc9a7947bc515sha1: dab9abdbd62f3a2d16aa8f3244cbc231dcde5ed1sha256: 45b50ea789225c3d921263c1b0aaf38c3e6139fcff97a0bfb69f42829d3eaaedsha512: 112ab670cd411c88db35b2e03331b7f063cc168357196473cc07482b07e467241b894d423141792d8c88c6ac14496736dcc2088a075b05595ccaf12952b19217ssdeep: 1536:7JbUgdmwwdfvRJKScb0CVKYb8doLo+9p2BqDnCmF9AAhlu:7ndmwsLiY9Yb8dojpnDdF91hlutype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AB839E8B779084B3C0E6063026963B395ABF6C745969ADA7EF10F4C63CB10E5E539E43sha3_384: 08d6f1b6f58b4ea9e3cdfd8e4c8f61ccc51d3e9bb65f3dc16edca9d93522448d07c2ca0de14d22988837bcb109526a5cep_bytes: 558bec81ec340700005356576a4033dbtimestamp: 2012-04-08 10:24:03
Version Info:
0: [No Data]

Doina.18762 also known as:

Bkav	W32.AIDetectMalware
DrWeb	Trojan.AVKill.14165
MicroWorld-eScan	Gen:Variant.Doina.18762
FireEye	Generic.mg.0087bce20abac0db
CAT-QuickHeal	TrojanPWS.OnLineGame.LP5
Skyhigh	BehavesLike.Win32.Generic.mh
ALYac	Gen:Variant.Doina.18762
Malwarebytes	Generic.Malware.AI.DDS
VIPRE	Gen:Variant.Doina.18762
Sangfor	Suspicious.Win32.Save.ins
K7AntiVirus	Password-Stealer ( 0040f7d11 )
BitDefender	Gen:Variant.Doina.18762
K7GW	Password-Stealer ( 0040f7d11 )
Cybereason	malicious.bd62f3
BitDefenderTheta	AI:Packer.FDA7BBCC20
Symantec	Trojan.Zeroaccess.C
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/PSW.OnLineGames.QNW
APEX	Malicious
ClamAV	Win.Trojan.Onlinegames-10011830-0
Kaspersky	Trojan-Dropper.Win32.Agent.hhwa
Alibaba	TrojanPSW:Win32/OnLineGames.0ea428d9
NANO-Antivirus	Trojan.Win32.AVKill.fjemut
ViRobot	Trojan.Win32.A.PSW-Kykymber.48028.C
Rising	Stealer.Zuten!1.64CA (CLASSIC)
TACHYON	Trojan-Dropper/W32.Agent.87452
Sophos	Mal/PWS-AL
F-Secure	Heuristic.HEUR/AGEN.1322555
Baidu	Win32.Trojan-Downloader.Agent.j
Zillya	Dropper.Agent.Win32.237498
TrendMicro	TROJ_SPNR.38JG13
Trapmine	malicious.high.ml.score
Emsisoft	Gen:Variant.Doina.18762 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Trojan/Generic.sknn
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/Kazy.39008.9
Varist	W32/OnLineGames.KT.gen!Eldorado
Antiy-AVL	Trojan[Dropper]/Win32.Agent
Kingsoft	malware.kb.a.1000
Microsoft	PWS:Win32/OnLineGames.LP
Xcitium	TrojWare.Win32.Downloader.Agent.KAC@4l1z3a
Arcabit	Trojan.Doina.D494A
ZoneAlarm	Trojan-Dropper.Win32.Agent.hhwa
GData	Gen:Variant.Doina.18762
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.OnlineGameHack.R39468
McAfee	GenericRXEK-DZ!0087BCE20ABA
MAX	malware (ai score=100)
DeepInstinct	MALICIOUS
VBA32	Heur.Trojan.Hlux
Cylance	unsafe
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_SPNR.38JG13
Tencent	Trojan.TenThief.QQPsw.bns
Yandex	Trojan.GenAsa!3e66IijIDAQ
Ikarus	Trojan.Win32.VB
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Onlinegames.QNW!tr
AVG	Win32:Evo-gen [Trj]
Avast	Win32:Evo-gen [Trj]
CrowdStrike	win/malicious_confidence_100% (W)