Win32:CiaDoor-ALP [Trj] removal guide

The Win32:CiaDoor-ALP [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32:CiaDoor-ALP [Trj] virus can do?

The binary contains an unknown PE section name indicative of packing
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Win32:CiaDoor-ALP [Trj]?


File Info:
name: A7838B666FE6BE6C2E95.mlw
path: /opt/CAPEv2/storage/binaries/cf76a3a8e7863c25396e6e79d49c875702cd0e86570d137de6209210ee3927b9
crc32: 9AC9FA2B
md5: a7838b666fe6be6c2e9595eaafe6bf7d
sha1: fc2c4c01ffac55cbcd8e8f658b18dd1a11e08fe0
sha256: cf76a3a8e7863c25396e6e79d49c875702cd0e86570d137de6209210ee3927b9
sha512: 9b2e704ed73c47ab345b9319b736aca66df20dd84924f7a7ffbe16078d333382464d02f22ad0dd5e076c15d588b8d57bd392364132ec182a1b516c71bae70d89
ssdeep: 1536:0aZDv5sWpneBlqd3AL9UuC2pac61MhBjWSmqZKp7EiFHf4qMGTiUKy7jqB:hZ5sW5eezPCc1MvzmqgpT7TiUKYj
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T14AA33C2DF40B6E7DE6675930548040A0CA6D1C2B603AB777B760F7FA1F72450C1E6E6A
sha3_384: c49e497c8351c5d3b35919254a48a1751d106e034d3727ed8204734457845b6df0c434d3a37866fd41f164c9d4bb9b47
ep_bytes: fc5550e8000000005d60e80300000083
timestamp: 2006-02-19 10:09:30

Version Info:
Translation: 0x0409 0x04b0
ProductName: cvshost
FileVersion: 2.00
ProductVersion: 2.00
InternalName: stub
OriginalFilename: stub.exe

Win32:CiaDoor-ALP [Trj] also known as:

Lionic	Trojan.Win32.Ciadoor.4!c
tehtris	Generic.Malware
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan ( 005324fe1 )
Alibaba	Backdoor:Win32/Ciadoor.11829eb2
K7GW	Trojan ( 005324fe1 )
Cybereason	malicious.1ffac5
VirIT	Trojan.Win32.VBCrypt.GD
Symantec	Trojan.Gen.MBT
Elastic	malicious (moderate confidence)
APEX	Malicious
Avast	Win32:CiaDoor-ALP [Trj]
Cynet	Malicious (score: 100)
Kaspersky	Backdoor.Win32.Ciadoor.ar
SUPERAntiSpyware	Backdoor.Ciadoor
Tencent	Win32.Backdoor.Ciadoor.Ocnw
F-Secure	Backdoor.BDS/Ciadoor.1.31
McAfee-GW-Edition	BehavesLike.Win32.Generic.cc
Sophos	Mal/Generic-S
SentinelOne	Static AI – Malicious PE
Avira	BDS/Ciadoor.1.31
Xcitium	Heur.Corrupt.PE@1z141z3
ZoneAlarm	Backdoor.Win32.Ciadoor.ar
Microsoft	Trojan:Script/Phonzy.B!ml
TrendMicro-HouseCall	TROJ_GEN.R002H07HR23
Rising	Trojan.Generic@AI.100 (RDML:/6Y2QzC10WeUxWZJszDKbg)
Yandex	Trojan.DL.VB.WPN
Ikarus	Trojan.Win32.Genome
AVG	Win32:CiaDoor-ALP [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32:CiaDoor-ALP [Trj]?

Win32:CiaDoor-ALP [Trj] removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X