Backdoor:Win32/Zegost.DB (file analysis)

The Backdoor:Win32/Zegost.DB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Backdoor:Win32/Zegost.DB virus can do?

Unconventionial language used in binary resources: Chinese (Simplified)

How to determine Backdoor:Win32/Zegost.DB?


File Info:
crc32: D5600C27
md5: 1c8cce1339a11b885006f1d06a006feb
name: 1C8CCE1339A11B885006F1D06A006FEB.mlw
sha1: b35f21e1e94e1b143f9be762e1b9647e802040d4
sha256: 06d845352dee5e918aae594cd5f2fe379e9f97c2a70d7bb20bf3da0d1f3dc4bd
sha512: 52a384e0a4b34194413d1a96f24c29a540d05185e5e40a28066d1b976e3bcb46c8bed7c7f3678a15f837784379f0437ca253dd72ab2655efb446ff18df54feea
ssdeep: 6144:PpjDS3t31eZCT0pCEJKUi1Z/JWZFrpbNyyG1SpYV:PhZ60NJKUi1Z/2rpb9ri
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Freeware - by Cronos
InternalName: QQPC
FileVersion: 2.28
CompanyName: QQPC
PrivateBuild: 
LegalTrademarks: 
Comments: 
ProductName: QQPC
SpecialBuild: 
ProductVersion: 
FileDescription: Borg Disassembler
OriginalFilename: 
Translation: 0x0409 0x04e4

Backdoor:Win32/Zegost.DB also known as:

MicroWorld-eScan	Trojan.GenericKD.36255600
FireEye	Trojan.GenericKD.36255600
CAT-QuickHeal	Backdoor.Lotok
McAfee	Artemis!1C8CCE1339A1
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
AegisLab	Trojan.Win32.Lotok.m!c
Sangfor	Malware
BitDefender	Trojan.GenericKD.36255600
K7GW	Riskware ( 0040eff71 )
K7AntiVirus	Riskware ( 0040eff71 )
BitDefenderTheta	Gen:NN.ZexaCO.34804.yy0@aGadc!lj
Cyren	W32/Trojan.JQLP-3963
Symantec	Trojan.Gen.MBT
APEX	Malicious
Avast	Win32:Malware-gen
Kaspersky	HEUR:Backdoor.Win32.Lotok.gen
Alibaba	TrojanDownloader:Win32/Lotok.36787314
Ad-Aware	Trojan.GenericKD.36255600
Emsisoft	Trojan.GenericKD.36255600 (B)
F-Secure	Backdoor.BDS/Redcap.onkgx
DrWeb	Trojan.DownLoader36.37354
Zillya	Backdoor.Lotok.Win32.506
McAfee-GW-Edition	Artemis!Trojan
Sophos	Mal/Generic-S
Webroot	W32.Trojan.Gen
Avira	BDS/Redcap.onkgx
MAX	malware (ai score=82)
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Backdoor:Win32/Zegost.DB
Arcabit	Trojan.Generic.D2293770
ZoneAlarm	HEUR:Backdoor.Win32.Lotok.gen
GData	Trojan.GenericKD.36255600
Cynet	Malicious (score: 85)
AhnLab-V3	Malware/Win32.Generic.C4307694
ALYac	Trojan.GenericKD.36255600
Malwarebytes	Generic.Malware/Suspicious
Panda	Trj/GdSda.A
ESET-NOD32	Win32/TrojanDownloader.Agent.FNB
TrendMicro-HouseCall	TROJ_GEN.R002H0CAU21
Rising	Downloader.Agent!1.D203 (CLASSIC)
Ikarus	Trojan-Downloader.Win32.Agent
Fortinet	Malicious_Behavior.SB
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Trojan.Generic

How to remove Backdoor:Win32/Zegost.DB?

Backdoor:Win32/Zegost.DB removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X