Categories: Malware

Doina.25132 removal tips

The Doina.25132 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.25132 virus can do?

Reads data out of its own binary image
Drops a binary and executes it
The binary likely contains encrypted or compressed data.
The executable is compressed using UPX
Installs itself for autorun at Windows startup
Creates a copy of itself

Related domains:

static.windupdates.com

How to determine Doina.25132?


File Info:
crc32: E21BE3A1md5: 9ce744126e49e069e1936edbedbff977name: 9CE744126E49E069E1936EDBEDBFF977.mlwsha1: 251d72aa84c522216d78727b59eb5ab1d668c7c8sha256: b218dd4f4591d75fb8dfd0805233908d247839cc5ae2660122803f5f4b59d301sha512: 44707af233e6e65516d64318662073635aa8223110982a74e0cdfa2c41f4c3b12d5fa98d70ed6e163a3660ddc25114ecca2ca43e8d689f9f156d505433e4180bssdeep: 768:bfpQX4vNsTeVH/5GY1+vUqgBJ24Hmf67ZzVrYabNlEpUy3B+As:bhQaNeexxGYsYBJogOa5mpx+Astype: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Version Info:
LegalCopyright: Copyright 2005InternalName: LoaderXFileVersion: 1, 0, 0, 1CompanyName: ProductName: LoaderX ModuleOLESelfRegister: ProductVersion: 1, 0, 0, 1FileDescription: LoaderX ModuleOriginalFilename: LoaderX.EXETranslation: 0x0409 0x04b0

Doina.25132 also known as:

K7AntiVirus	Adware ( 004bb0391 )
Lionic	Trojan.Win32.Agent.lgJD
Elastic	malicious (high confidence)
DrWeb	Adware.Winad
Cynet	Malicious (score: 100)
CMC	Generic.Win32.9ce744126e!MD
ALYac	Gen:Variant.Doina.25132
Cylance	Unsafe
Zillya	Adware.WinAD.Win32.108
Sangfor	Suspicious.Win32.Save.a
Alibaba	AdWare:Win32/WinAD.521fa44c
K7GW	Adware ( 004bb0391 )
Cybereason	malicious.a84c52
Cyren	W32/Windu.CELJ-6656
Symantec	Adware.Windupdates
ESET-NOD32	Win32/Adware.WUpd
APEX	Malicious
Avast	Win32:WinAd-U [PUP]
Kaspersky	not-a-virus:AdWare.Win32.WinAD.as
BitDefender	Gen:Variant.Doina.25132
NANO-Antivirus	Riskware.Win32.WinAD.xmbq
MicroWorld-eScan	Gen:Variant.Doina.25132
Tencent	Win32.Adware.Winad.Hyjv
Ad-Aware	Gen:Variant.Doina.25132
Sophos	Mal/Generic-R + Mal/Behav-026
Comodo	Application.Win32.Adware.WUpd@2vxt
BitDefenderTheta	Gen:NN.ZexaF.34170.cmKfa8Va4nhi
VIPRE	Backdoor.Poebot (fs)
TrendMicro	ADW_WINAD.V
McAfee-GW-Edition	Adware-WinAd.r
FireEye	Generic.mg.9ce744126e49e069
Emsisoft	Gen:Variant.Doina.25132 (B)
SentinelOne	Static AI – Malicious PE
Jiangmin	Adware/WinAD.ae
Webroot	Adware.WinAd
Avira	TR/Downloader.Gen
eGambit	Unsafe.AI_Score_99%
Antiy-AVL	GrayWare[AdWare]/Win32.WinAD
Kingsoft	Win32.Troj.WinAD.as.(kcloud)
Microsoft	Trojan:Win32/Wacatac.A!ml
Arcabit	Trojan.Doina.D622C
SUPERAntiSpyware	Trojan.Agent/Gen-LoaderX
ZoneAlarm	not-a-virus:AdWare.Win32.WinAD.as
GData	Gen:Variant.Doina.25132
TACHYON	Trojan-Clicker/W32.WinAd.114688
AhnLab-V3	Trojan/Win32.HDC.C103230
McAfee	Artemis!9CE744126E49
MAX	malware (ai score=100)
VBA32	suspected of Adware.WinAD.1
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	ADW_WINAD.V
Rising	Adware.WinAD.f (CLASSIC)
Yandex	Trojan.GenAsa!UuhQcO94dyI
Ikarus	not-a-virus:AdWare.Win32.WinAD
MaxSecure	Trojan.Malware.680999.susgen
Fortinet	Adware/WinAd
AVG	Win32:WinAd-U [PUP]
Paloalto	generic.ml