PWS:Win32/Zbot.AHE removal

The PWS:Win32/Zbot.AHE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Zbot.AHE virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Finnish
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine PWS:Win32/Zbot.AHE?

File Info:
name: 049B66F8B4C83D55789F.mlw
path: /opt/CAPEv2/storage/binaries/8c08af5ee3368eb401608454d885eb580f8a32041c6ddffa2469aca166a0c7f0
crc32: D3C8E81D
md5: 049b66f8b4c83d55789f442743c8b900
sha1: c8c63cb2428eb0d6f82fa776cdd207ccf4f08575
sha256: 8c08af5ee3368eb401608454d885eb580f8a32041c6ddffa2469aca166a0c7f0
sha512: 9101263de482d510de8fa123f3ab0bb3dc4ff852b0aa5fd676af836c3e4ea1e3c2b77cddef8ab6183f7ea0babc2269f30fb1b96a3d34fe55ed67243364e3b1c2
ssdeep: 6144:DQvSbCa12YnOeYTya+iEo9/GnCmEPq2ii7z9jphmOL:Uvla1XOeI+iEote3EPviM9jph
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AE340203E78B8372D2B175B5459B9F1D1E79AAC112402C1703EDADAE3B5E3B1708B768
sha3_384: 211bf94926f1f1f43e688bb03e59104fbee8fc4f6d7d25640ff150de380b507ed9a6241e783fcfa236126b194db49d69
ep_bytes: 558bec83c4908b0d30f9410081c10018
timestamp: 2010-02-23 07:49:20

Version Info:
CompanyName: Gq0h5eozdqvGxG
FileVersion: 47.246.48144.56163
InternalName: 7aE5
OriginalFilename: naa6eQMNh
ProductName: dUdGIoWRihcGgQ
ProductVersion: 191.226.61897.7350
Translation: 0x0409 0x04b0

PWS:Win32/Zbot.AHE also known as:

How to remove PWS:Win32/Zbot.AHE?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.