Categories: Malware

How to remove “Doina.2728”?

The Doina.2728 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.2728 virus can do?

SetUnhandledExceptionFilter detected (possible anti-debug)
Yara rule detections observed from a process memory dump/dropped files/CAPE
Dynamic (imported) function loading detected
Enumerates running processes
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid
Attempts to modify browser security settings

How to determine Doina.2728?


File Info:
name: 61BACB6A8CD72EB0D777.mlwpath: /opt/CAPEv2/storage/binaries/ca375ffd0b0dc6cc11355277e38ce5889f2522d3c6434c71aad0a0135caabbe9crc32: 6051EBE2md5: 61bacb6a8cd72eb0d7773bd665821b26sha1: a9c19feb0969f8d3b8d629c4ad9276d2b04d4840sha256: ca375ffd0b0dc6cc11355277e38ce5889f2522d3c6434c71aad0a0135caabbe9sha512: bcc94f80f56e5ec13c891f7dbae183088da5aaae44676406002e5040ec0983927df01d57a798cbdea702b594c2e30a031063a09dffb471f275c154dbbfa28d50ssdeep: 49152:gK6Eb+hE585gjGgK+LiqeOAmzrAEqe8doFbOYX5v1pWKp:gK6Ebj85gKgpLiqeOAmzrAEqe8doFbOetype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1C4C58D21BDF14637C1731731895EF2B870ADADA01B2585CB63C82E9D3E305F29A39667sha3_384: c881ce9d8f7f11d22e972ed22957e03edd9e5b73d4d42e9f7e738cbeaeac3295dcde8cf633ca548405cea0f032d25e91ep_bytes: e8c40c0000e98efeffff3b0d60606100timestamp: 2020-09-22 06:53:58
Version Info:
Comments: CompanyName: FileDescription: MiniNews新闻FileVersion: 11.0.0.7InternalName: KYiemeLegalCopyright: Copyright (c) 2020OriginalFilename: KYieme.exeProductName: ProductVersion: 11.0.0.7Translation: 0x0804 0x04b0

Doina.2728 also known as:

Lionic	Riskware.Win32.Doina.1!c
MicroWorld-eScan	Gen:Variant.Doina.2728
FireEye	Gen:Variant.Doina.2728
CAT-QuickHeal	PUA.WacapewRI.S18676190
McAfee	GenericRXOT-ZG!61BACB6A8CD7
Zillya	Tool.YouXun.Win32.1344
K7AntiVirus	Riskware ( 0057a9901 )
K7GW	Riskware ( 0057a9901 )
Cybereason	malicious.a8cd72
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/RiskWare.YouXun.AD
BitDefender	Gen:Variant.Doina.2728
Avast	Win32:MiscX-gen [PUP]
Tencent	Uw:Adware.Win32.Ddlive.yc
Ad-Aware	Gen:Variant.Doina.2728
Sophos	Mal/Generic-S
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0PL221
McAfee-GW-Edition	GenericRXOT-ZG!61BACB6A8CD7
Emsisoft	Gen:Variant.Doina.2728 (B)
Ikarus	PUA.RiskWare.Youxun
GData	Gen:Variant.Doina.2728
Jiangmin	AdWare.KuwanBar.ab
Antiy-AVL	Trojan/Generic.ASMalwS.334411B
ViRobot	Adware.Youxun.2510848.C
Microsoft	Trojan:Win32/Wacatac.A!ml
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZexaF.34062.zI0@a8dBk2ij
ALYac	Gen:Variant.Doina.2728
MAX	malware (ai score=82)
VBA32	BScope.Trojan.FakeAlert
TrendMicro-HouseCall	TROJ_GEN.R002C0PL221
Rising	Adware.AdPop!1.D0D7 (CLASSIC)
Yandex	RiskWare.YouXun!Hg7JL8CkJ4E
SentinelOne	Static AI – Suspicious PE
Fortinet	Riskware/YouXun.AD
Webroot	W32.Adware.Gen
AVG	Win32:MiscX-gen [PUP]
CrowdStrike	win/malicious_confidence_60% (D)