Doina.7153 removal instruction

The Doina.7153 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Doina.7153 virus can do?

• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Detects Bochs through the presence of a registry key
• Attempts to modify proxy settings
• Attempts to modify browser security settings
• Creates a copy of itself
• Deletes executed files from disk
• Harvests cookies for information gathering

How to determine Doina.7153?

File Info:
name: 7D6B20DCF706EF13474A.mlw
path: /opt/CAPEv2/storage/binaries/4fd8059a2aed91e4cc9afdb6dce1995c310d5cc3dab5217eae9506ac1b01d82a
crc32: E0C765EB
md5: 7d6b20dcf706ef13474ade36360756c6
sha1: 16a5fc06046a0ba6b107063fcad2430177af5111
sha256: 4fd8059a2aed91e4cc9afdb6dce1995c310d5cc3dab5217eae9506ac1b01d82a
sha512: 38d14bf18fcff28d7dd6662028e83d0d1afa9742834c213f2eb750bd92d6b67bde31f714927011b626ca96a770ecdc58403fe3375e2f17108f81ee5539f36667
ssdeep: 24576:tDTk5JPgslAt8lPivBbm5iNS4l5MmS946+oo5c4MR9eLpK4DINdS:ttiT4U46Ic4MRsbDINdS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T159855963A35180F0D69A013197BA633C6478BB620D35EF63FBC9DEA45C217D1EE1622D
sha3_384: 5cdac5bfb8cbff0bc009b678728fd713b5b887244c8e3927cf66b0a39698c17121d215c667573d5cce087f81a79dd6e9
ep_bytes: 558bec6aff6880f34500682065450064
timestamp: 2016-07-13 04:29:44

Version Info:
FileVersion: 1.7.0.0
FileDescription:  
ProductName:  
ProductVersion: 1.7.0.0
CompanyName:  
LegalCopyright:  
Comments: 本程序使用易语言编写(http://www.dywt.com.cn)
Translation: 0x0804 0x04b0

Doina.7153 also known as:

How to remove Doina.7153?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.