Backdoor:Win32/Zegost.BQ removal guide

The Backdoor:Win32/Zegost.BQ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Backdoor:Win32/Zegost.BQ virus can do?

• Unconventionial binary language: Chinese (Simplified)
• Unconventionial language used in binary resources: Chinese (Simplified)
• Authenticode signature is invalid
• CAPE detected the PCRat malware family
• Binary file triggered YARA rule
• Yara detections observed in process dumps, payloads or dropped files

How to determine Backdoor:Win32/Zegost.BQ?

File Info:
name: C1B718BAC224439B758D.mlw
path: /opt/CAPEv2/storage/binaries/409cf90f61600a2fb31ccdc82c5b6d4fbc454b2aa3ed3d33b536b0b3b5a2d451
crc32: 45F1F21A
md5: c1b718bac224439b758d5540f3b9bc22
sha1: 1dc15b8907bb2882cb3a33dc5b5ddf0f278c5ffa
sha256: 409cf90f61600a2fb31ccdc82c5b6d4fbc454b2aa3ed3d33b536b0b3b5a2d451
sha512: e70d9bcfae2583789958c776d453821c0324a3bb9f15dfad80fc20751bfeb0444372ea5b3b9b8297a7cbbf406f76b86cad3445851df6f887a2592545b4227f7c
ssdeep: 3072:HFbj3oYw4ek4WtyLv52HGVjqDxOegUB6M4aT1:HFbjm4ek4XTMDgtUB6Mz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T186D33B00E645856ED4B704B288AABF7BED68F9740718E443B3D8DD1A29741F86B3274F
sha3_384: 63de8423ea92b8046997c8032cb7b0826cd1db6e97287451ecf0eb53f214be500d21f2902a6944afb20562a66ef84ad5
ep_bytes: 558bec6aff68a891410068ca78410064
timestamp: 2012-10-31 16:10:31

Version Info:
Comments: 
CompanyName: Microsoft Corporation
FileDescription: 5.1.2600.5512 (xpsp.080413-2111)
FileVersion: 1, 0, 0, 1
InternalName: Microsoft? Windows? Operating System
LegalCopyright: 版权所有(C) 2012
LegalTrademarks: 
OriginalFilename: smss.exe
PrivateBuild: 
ProductName: Microsoft Corporation Client
ProductVersion: 2, 2, 3140, 0
SpecialBuild: 
Translation: 0x0804 0x04b0

Backdoor:Win32/Zegost.BQ also known as:

How to remove Backdoor:Win32/Zegost.BQ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.