Doina.41003 removal tips

The Doina.41003 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.41003 virus can do?

• Executed a command line with /C or /R argument to terminate command shell on completion which can be used to hide execution
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• Performs HTTP requests potentially not found in PCAP.
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Attempts to modify proxy settings
• Deletes executed files from disk
• Harvests information related to installed instant messenger clients
• Harvests information related to installed mail clients
• Anomalous binary characteristics
• Uses suspicious command line tools or Windows utilities
• Uses XCOPY for copying files

How to determine Doina.41003?

File Info:
name: 7DF0C6A31BCB8884CC25.mlw
path: /opt/CAPEv2/storage/binaries/726ac2e71b084351d0fe2457bf12618762fec60c8ddf0475644ea5c2a314a0b9
crc32: 533EA555
md5: 7df0c6a31bcb8884cc2561331cc29131
sha1: 7508b204299dc0e464fc2e919794430ca41532bf
sha256: 726ac2e71b084351d0fe2457bf12618762fec60c8ddf0475644ea5c2a314a0b9
sha512: 86b65b1e109a9259f79cbee433db89bb56fead167c23ac46b8f4fd9aecd4ded1f4e964583a21743cec74bddce64523c90eb3404bb992fe155bfc59f103013d96
ssdeep: 24576:7NT+G7+lsA+bbs1/M4rxotaxw2DWNkw2fyqi4w:7NT+G7osAR1/ZNlw2YbX/
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1593512113B91C832C2636A774916C775BABAB6209F3556C7B7E00F3DDF742C19A3824A
sha3_384: b271153ea9d799459799b5645ddc35fae7de8ba5af8a2bdc5b9b80e2bcf878169ffdd447f7567f6374e6b8d33779b3d3
ep_bytes: e899000000e978feffff8bff558bec6a
timestamp: 2012-03-01 21:16:53

Version Info:
0: [No Data]

Doina.41003 also known as:

How to remove Doina.41003?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.