Should I remove “Doina.8490”?

The Doina.8490 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Doina.8490 virus can do?

Possible date expiration check, exits too soon after checking local time
Unconventionial language used in binary resources: Korean
Sniffs keystrokes
Installs an hook procedure to monitor for mouse events

How to determine Doina.8490?


File Info:
crc32: 395A809C
md5: 8e34ed35791e864e6c8028c1ca6f969a
name: 8E34ED35791E864E6C8028C1CA6F969A.mlw
sha1: d932b5a22a72c7e1caf89c205463a636a4178867
sha256: 4cfd4c31c834dc25798bb758a6537e2f5069fb7515d58a779a8f2cd431cf4d66
sha512: bb6d9b5eae1a8a271dbba2be5a9668bbb8552e0b7399c92bb87a4b245d6b28ba7d38ead9e32658102a90b69135e20df638a4d56833993529ea3a8365bd1f3e0b
ssdeep: 384:hG6BlPMfuoAP7ZrWcWN7S26rQ7K8TZzdRZBSYSe+gLjd19I8qY:rBlPMfuXP16NN7ZMQ9vRZBSYSehLf9H
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright (C) 2013
InternalName: htmlsafe32
FileVersion: 5, 0, 0, 11
CompanyName: YOONDISK
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: noscreen
SpecialBuild: 
ProductVersion: 5, 0, 0, 11
FileDescription: Html_safe
OriginalFilename: htmlsafe32
Translation: 0x0412 0x04b0

Doina.8490 also known as:

ALYac	Gen:Variant.Doina.8490
Sangfor	Suspicious.Win32.Doina.8490
BitDefender	Gen:Variant.Doina.8490
Symantec	Ransom.Wannacry
APEX	Malicious
MicroWorld-eScan	Gen:Variant.Doina.8490
Ad-Aware	Gen:Variant.Doina.8490
FireEye	Generic.mg.8e34ed35791e864e
Emsisoft	Gen:Variant.Doina.8490 (B)
Microsoft	Program:Win32/Wacapew.C!ml
AegisLab	Trojan.Win32.Doina.4!c
GData	Gen:Variant.Doina.8490
AhnLab-V3	Malware/Win.KD.C4406034
McAfee	GenericRXOE-TH!8E34ED35791E
MAX	malware (ai score=87)
VBA32	BScope.Trojan.Diztakun
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R011H06DF21
Rising	Malware.Heuristic!ET#83% (RDMK:cmRtazrxcWWzMyU+5mf8WDpRhFaT)
Fortinet	W32/Wacapew.C!tr
Qihoo-360	Win32/Trojan.Generic.HgIASSoA

How to remove Doina.8490?

Doina.8490 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X