How to remove “Backdoor:MSIL/Tzeebot.B”?

The Backdoor:MSIL/Tzeebot.B is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:MSIL/Tzeebot.B virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Presents an Authenticode digital signature
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid

How to determine Backdoor:MSIL/Tzeebot.B?

File Info:
name: 221AE1CD4BBC019D6337.mlw
path: /opt/CAPEv2/storage/binaries/d9813f4bc13d5e0353523feaa4c74d4218c2598dd1e3c05d3660d7932497b906
crc32: C75C66AB
md5: 221ae1cd4bbc019d6337aef3875ac5be
sha1: b156f7e159b77d7496ac8e906899f2f6f05b7487
sha256: d9813f4bc13d5e0353523feaa4c74d4218c2598dd1e3c05d3660d7932497b906
sha512: ea7de72ba28819567e493995457f6910a6d5157473792994ff51c2955ed9a11ef8ec0617f793cb783db8ec338d7d7d8fb49ebf08dcd6d3215064cedb81f0f9ff
ssdeep: 196608:QpO0Gz6Xg7be/NPAc8HrtH6n//hJqaKJEUux7+6fA53:p0G9IA99+kNJEHPO3
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1338633B8068E6F9BDA9C987104619D830775E2672601F7FB640CA26C7DB03FF682615F
sha3_384: b5c739a6795223f824f5b78cb6b771711af4ea4b1efbfb6840b3ba7b1cfa136313d38237dac5a11b0fdeb1c170acad42
ep_bytes: ff250020400000000000000000000000
timestamp: 2013-04-27 06:43:43

Version Info:
Translation: 0x0000 0x04b0
CompanyName: Microsoft
FileDescription: Microsot Setup Installer
FileVersion: 1.0.0.0
InternalName: Setup Update Installer.exe
LegalCopyright: Copyright © Microsoft 2012
OriginalFilename: Setup Update Installer.exe
ProductVersion: 1.0.0.0
Assembly Version: 1.0.0.0

Backdoor:MSIL/Tzeebot.B also known as:

How to remove Backdoor:MSIL/Tzeebot.B?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.