Categories: Malware

PWS:Win32/Zbot.AIR removal guide

The PWS:Win32/Zbot.AIR is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Zbot.AIR virus can do?

At least one process apparently crashed during execution
Unconventionial language used in binary resources: Russian
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine PWS:Win32/Zbot.AIR?


File Info:
name: 13C311E55A1E2811857C.mlwpath: /opt/CAPEv2/storage/binaries/82c5371db4f0b0225bae92acb3dd20dffb9364a620ea4ef97d2ceb1c2dbd8f6ccrc32: FEC2A498md5: 13c311e55a1e2811857cf46647b8abf0sha1: 22794b9fa7c3531086ded192219b04c7331e695csha256: 82c5371db4f0b0225bae92acb3dd20dffb9364a620ea4ef97d2ceb1c2dbd8f6csha512: 70fccddcdc98631d6054d15de277460d08142cafeed8187e04cc21ef0ce086c229bcb6c8f6cda6ac5704677653121c0df3afe3e0ea8f8f04c53cb0b7b09694bessdeep: 6144:0u4qvoDkcuGkc+eSMdvro0GqqL6dkpjofuKLw:0uqvMbGdkpzdtype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1AF44145219288E6CEF954BB088D997889676DF3F11A4E14EE36CF07B543B38605D33CAsha3_384: 163de97984eb3f169b17e7f6215aac92df9a90fd71ed2088dc6b2456ea314744ee2c78941e681bd87b0285261737737fep_bytes: 6a6068e0504000e8810d0000bf940000timestamp: 2012-05-30 12:14:09
Version Info:
0: [No Data]

PWS:Win32/Zbot.AIR also known as:

Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Panda.2357
MicroWorld-eScan	Gen:Variant.Symmi.16042
FireEye	Generic.mg.13c311e55a1e2811
McAfee	PWS-Zbot.gen.bfp
Cylance	Unsafe
Zillya	Trojan.Zbot.Win32.61427
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 003c36381 )
Alibaba	TrojanPSW:Win32/Citadel.428022b9
K7GW	Trojan ( 003c36381 )
Cybereason	malicious.55a1e2
Arcabit	Trojan.Symmi.D3EAA
BitDefenderTheta	Gen:NN.ZexaF.34232.qqX@aeMQkxcc
VirIT	Trojan.Win32.Zyx.KY
Cyren	W32/A-0b9ab12a!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Spy.Zbot.AAQ
TrendMicro-HouseCall	TROJ_GEN.R002C0CB822
ClamAV	Win.Trojan.Zbot-22550
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Symmi.16042
NANO-Antivirus	Trojan.Win32.Panda.demjto
Avast	Win32:Citadel [Trj]
Tencent	Malware.Win32.Gencirc.114927b1
Ad-Aware	Gen:Variant.Symmi.16042
TACHYON	Trojan-Spy/W32.ZBot.272384.S
Emsisoft	Gen:Variant.Symmi.16042 (B)
Comodo	TrojWare.Win32.Cerber.BAA@6hzktm
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0CB822
McAfee-GW-Edition	BehavesLike.Win32.ZBot.dc
Sophos	Mal/Generic-S
Ikarus	Trojan-Spy.Win32.Zbot
Jiangmin	TrojanSpy.Zbot.bsgq
Avira	TR/Crypt.ZPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.120A7B
Gridinsoft	Ransom.Win32.Zbot.sa
Microsoft	PWS:Win32/Zbot.AIR
SUPERAntiSpyware	Trojan.Agent/Gen-Menti
GData	Gen:Variant.Symmi.16042
Cynet	Malicious (score: 100)
AhnLab-V3	Spyware/Win32.Zbot.R28557
Acronis	suspicious
VBA32	BScope.TrojanPSW.Panda
ALYac	Gen:Variant.Symmi.16042
MAX	malware (ai score=99)
Malwarebytes	Malware.AI.3696200089
APEX	Malicious
Rising	Dropper.Generic!8.35E (CLOUD)
Yandex	Trojan.GenAsa!7mLyWQv/nFM
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.4084477.susgen
Fortinet	W32/Kryptik.AFVU!tr
Webroot	W32.Rogue.Gen
AVG	Win32:Citadel [Trj]
Panda	Trj/Genetic.gen
CrowdStrike	win/malicious_confidence_100% (D)