Aliases: Trojan.Tenegour.9 (Dr.Web) Downloader-CRD (McAfee) Troj/Bredo-TZ (Sophos)
Windows Defender Antivirus detects and removes this threat.
TrojanDownloader:Win32/Dofoil.O is a trojan that attempts to download arbitrary files from specified remote servers. This trojan may be encountered as a file attached to a spammed email message.
On March 6, 2018, behavior monitoring and machine learning technologies in Windows Defender Antivirus stopped a Dofoil variant (also known as Smoke Loader) that tried to infect more than 400,000 computers. The massive campaign aimed to install a cryptocurrency miner that uses victim computers' resources for coin mining purposes. Learn how artificial intelligence stopped the attack within minutes:
Windows Defender Antivirus automatically removes threats as they are detected. However, many infections can leave remnant files and system changes. Updating your antimalware definitions and running a full scan might help address these remnant artifacts.
To ensure you have the best protection, enable the following:
- Cloud-delivered protection
- Automatic sample submission
To access these settings on the Windows Defender Security Center app, use the Windows search box to find and open the Windows Defender Security Center. Navigate to Virus & threat protection settings.
Prevent malware infection
To prevent future infection, follow our guide on preventing malware infection.