TrojanDownloader:Win32/Dofoil!pz removal guide

The TrojanDownloader:Win32/Dofoil!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Dofoil!pz virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• The executable is compressed using UPX
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Behavioural detection: Injection (inter-process)
• CAPE detected the shellcode patterns malware family
• Checks the presence of disk drives in the registry, possibly for anti-virtualization
• Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDownloader:Win32/Dofoil!pz?

File Info:
name: 49AA0456ADDC1AD3DED6.mlw
path: /opt/CAPEv2/storage/binaries/b4599e93b89fd7041de09b0b360fe05d28676a0641d3bf2d07e93baf65a8eecf
crc32: 3F10583F
md5: 49aa0456addc1ad3ded65dac48c47334
sha1: 9c4daa5c3314d2db99f0c1351c2c1614bd637610
sha256: b4599e93b89fd7041de09b0b360fe05d28676a0641d3bf2d07e93baf65a8eecf
sha512: 417f0302c49050162ca2db21efd96d0051573926139cc9c1da8383759771a96643e5f3cd088c05cc30b084e61a3183503648913dc2ac4b30cf3f6339d601d4c6
ssdeep: 1536:iGyfaI90d54sFz0cYEqbUcWm5JQaqtoO73zBkRAlbDUU0qXcIV:iGyfaq0wsFXdq115lcoO7zBkRAlbDUU6
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CBA317F0F46BEE77F5C2403C6421A115C75B82B2EA569261F993F2EEA6F23507108C97
sha3_384: e60c16da163cf3ee781f15447c93ba2e3def7d54953158eda68c8aae5a6c0c355c09c6c650d3456e9e39c52165337728
ep_bytes: 60be008041008dbe0090feff5783cdff
timestamp: 2018-03-07 15:48:33

Version Info:
CompanyName: Siber          Systems
FileDescription: RoboForm TaskBar Icon
FileVersion: 7-9-15-8
InternalName: RoboTaskBarIcon
Translation: 0x0000 0x04b0

TrojanDownloader:Win32/Dofoil!pz also known as:

How to remove TrojanDownloader:Win32/Dofoil!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.