About “MSIL/Adware.Dotdo.HU” infection

The MSIL/Adware.Dotdo.HU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What MSIL/Adware.Dotdo.HU virus can do?

Dynamic (imported) function loading detected
Authenticode signature is invalid
Network activity detected but not expressed in API logs

How to determine MSIL/Adware.Dotdo.HU?


File Info:
name: 86A96EBC34FF85103001.mlw
path: /opt/CAPEv2/storage/binaries/d7a203389fe8d4bc07ff8b37ef87c9ef9b18950cefc7620e147197cc53def534
crc32: 2C3019B7
md5: 86a96ebc34ff85103001a41f475aec7a
sha1: 6ca591aaf7b7228555dca1380bbf1945e58ea1f8
sha256: d7a203389fe8d4bc07ff8b37ef87c9ef9b18950cefc7620e147197cc53def534
sha512: 0f5d8b0a7fda610d67825735b6e50a76b36089b253a16fcf855664e6d808afe4d723ed3eba4e8bf50ac5aab6a9b9090e3faa9a9d16ef0e7e99d75b1b635e5806
ssdeep: 96:hpyI2mfytPoOQUoI55thGw9pJNr8oJeSPkfftw8JZS0NTuJzNt:aIxyg1UXPLTAKP98JIA+
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A612281617C86A3AE83727B66D57C3708AA0FF488D97171D28D03A1F3E753A40E63622
sha3_384: 18cca562f0877ae99ece03940a22b0f775205d3021534c212fefd4dbf532ca55a87201eeb89ec6c8ff1c1d98c6901834
ep_bytes: ff250020400000000000000000000000
timestamp: 2021-11-13 06:07:08

Version Info:
Translation: 0x0000 0x04b0
FileDescription:  
FileVersion: 1.0.0.0
InternalName: relegation.exe
LegalCopyright:  
OriginalFilename: relegation.exe
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

MSIL/Adware.Dotdo.HU also known as:

Lionic	Trojan.MSIL.Zapchast.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.38081050
FireEye	Generic.mg.86a96ebc34ff8510
ALYac	Trojan.GenericKD.38081050
Cylance	Unsafe
K7AntiVirus	Adware ( 005577521 )
Alibaba	Trojan:MSIL/Zapchast.455c53f1
K7GW	Adware ( 005577521 )
Cyren	W32/DotDo.AB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Adware.Dotdo.HU
TrendMicro-HouseCall	TROJ_GEN.R002H0CKL21
Kaspersky	HEUR:Trojan.MSIL.Zapchast.gen
BitDefender	Trojan.GenericKD.38081050
Avast	Win32:Adware-gen [Adw]
Ad-Aware	Trojan.GenericKD.38081050
Emsisoft	Trojan.GenericKD.38081050 (B)
Comodo	Application.MSIL.Dotdo.DF@8m9j7r
McAfee-GW-Edition	BehavesLike.Win32.AdwareTskLnk.zt
Sophos	Generic PUA GM (PUA)
GData	Trojan.GenericKD.38081050
Avira	HEUR/AGEN.1134702
Arcabit	Trojan.Generic.D245121A
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
McAfee	Artemis!86A96EBC34FF
MAX	malware (ai score=82)
Malwarebytes	Adware.DotDo.Generic.TskLnk
APEX	Malicious
Tencent	Msil.Trojan.Zapchast.Ebqv
SentinelOne	Static AI – Malicious PE
Fortinet	MSIL/Agent.2494!tr
AVG	Win32:Adware-gen [Adw]
MaxSecure	Trojan.Malware.300983.susgen

How to remove MSIL/Adware.Dotdo.HU?

MSIL/Adware.Dotdo.HU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X