TrojanDownloader:Win32/Dofoil.AB removal tips

The TrojanDownloader:Win32/Dofoil.AB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Dofoil.AB virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Detects Sandboxie through the presence of a library
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Explorer.exe process established HTTP connections
• Checks the presence of disk drives in the registry, possibly for anti-virtualization
• Anomalous binary characteristics

How to determine TrojanDownloader:Win32/Dofoil.AB?

File Info:
name: 165A3CA4593DFCAC1002.mlw
path: /opt/CAPEv2/storage/binaries/ef0054e9ec2e62dfbdc671967abbd7043b7cd2be77712609d4173de3d8cf859f
crc32: 16E418E7
md5: 165a3ca4593dfcac1002bffd6ba9ffac
sha1: 0dc8d04984dea68eccae236ab8cb7a1ac288ac9f
sha256: ef0054e9ec2e62dfbdc671967abbd7043b7cd2be77712609d4173de3d8cf859f
sha512: cde0608faf746452f570340ac1f1caaad32f9c941d04bc454852b9ee2ba23cdfb8a9c6dae0d90bedf795cdf65799b35916edb36ad380d1620fb35f1a2902619b
ssdeep: 192:oMBRcrByA/el37nZH6ThbzdyYmQ1gy1MzcnZodT0GplfbBor6/fFv:0ByA/e57ZaTaug9uOpJi0
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19CD3B08433AC6ADEFE7D673ECE216C0067472116087E5E4D1B30429F25899C67270577
sha3_384: 530b431a3db3f0a34793da4a400a9722fb0658476899ccb4f3eccf3d392aa30d9b963cacb04641d4438819913cec8742
ep_bytes: 5589e5eb073b05801440007d683499b0
timestamp: 2018-02-21 14:53:11

Version Info:
0: [No Data]

TrojanDownloader:Win32/Dofoil.AB also known as:

How to remove TrojanDownloader:Win32/Dofoil.AB?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.