Categories: Malware

PWS:Win32/Zbot.AJB removal guide

The PWS:Win32/Zbot.AJB is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Zbot.AJB virus can do?

Behavioural detection: Executable code extraction – unpacking
Yara rule detections observed from a process memory dump/dropped files/CAPE
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Dynamic (imported) function loading detected
Reads data out of its own binary image
CAPE extracted potentially suspicious content
Authenticode signature is invalid
Anomalous binary characteristics

How to determine PWS:Win32/Zbot.AJB?


File Info:
name: 0987F93909EF5DED71B5.mlwpath: /opt/CAPEv2/storage/binaries/8cbc397f3eb1f6b1580978a9f319a27710745877749fbaadfc2f9aaa643b9e5dcrc32: 799CC2A6md5: 0987f93909ef5ded71b53b0cf8f7ddc8sha1: 01692cdb7b9fc0d23a323c33e6df45b61173abbdsha256: 8cbc397f3eb1f6b1580978a9f319a27710745877749fbaadfc2f9aaa643b9e5dsha512: 644f2d94a9bcb1fc63785c564a4b8987e5f590eacaaef9c0c2332e160b6c5fa5e964b1617aed745a13e7e55b56188db5f26d29c83d0c27be543a0f5d15c5f350ssdeep: 6144:jpBlZf/tzA0jdZ23REXme1jcmjn25S2O6g6pVKUDM3:tXg0xEholbn2IRiPctype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T1B67407E9AF014934E4091335991CC663EF11BFAC06354AAB3BD38E4B16F9DE68D2497Csha3_384: 41cf5b31bbe875316b6289b108a09f67155ab415c3091c6e032197f21289087f93038383cd4589c21e555d3c0ed6e573ep_bytes: 8bec892d58004500e8594003006887bftimestamp: 2013-09-04 14:04:55
Version Info:
0: [No Data]

PWS:Win32/Zbot.AJB also known as:

Bkav	W32.AIDetect.malware2
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Heur.Ransom.Cerber.2
FireEye	Generic.mg.0987f93909ef5ded
McAfee	PWSZbot-FFA!0987F93909EF
VIPRE	Trojan.Win32.Agent.aqdc (v)
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 0040eff71 )
BitDefender	Gen:Heur.Ransom.Cerber.2
K7GW	Riskware ( 0040eff71 )
Cybereason	malicious.909ef5
BitDefenderTheta	Gen:NN.ZexaF.34182.uqX@aWl@!Soi
VirIT	Trojan.Win32.Generic.CKQF
Symantec	Backdoor.Trojan
ESET-NOD32	a variant of Win32/Kryptik.BJQM
Avast	Win32:Malware-gen
Kaspersky	HEUR:Trojan.Win32.Generic
Alibaba	TrojanPSW:Win32/Kryptik.0e2ff5df
NANO-Antivirus	Trojan.Win32.Zbot.crdfka
Rising	Trojan.Win32.Generic.15DD6F1C (C64:YzY0Oj21h/c18a82)
Emsisoft	Gen:Heur.Ransom.Cerber.2 (B)
Comodo	TrojWare.Win32.Kryptik.BJST@520md0
DrWeb	Trojan.PWS.Panda.4379
Zillya	Trojan.Zbot.Win32.134545
McAfee-GW-Edition	BehavesLike.Win32.Generic.fh
Sophos	ML/PE-A + Mal/EncPk-MP
SentinelOne	Static AI – Malicious PE
Jiangmin	TrojanSpy.Zbot.dtst
Avira	HEUR/AGEN.1245361
Antiy-AVL	Trojan/Generic.ASMalwS.3E9AAC
Microsoft	PWS:Win32/Zbot.AJB
SUPERAntiSpyware	Trojan.Agent/Gen-Blocker
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Heur.Ransom.Cerber.2
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win32.Zbot.R81603
VBA32	TrojanSpy.Zbot
ALYac	Gen:Heur.Ransom.Cerber.2
TACHYON	Trojan-Spy/W32.ZBot.337920.AB
Panda	Trj/Zbot.M
APEX	Malicious
Yandex	Trojan.GenAsa!kjoUD9cd4AU
MAX	malware (ai score=87)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Bublik.BEUK!tr
AVG	Win32:Malware-gen
CrowdStrike	win/malicious_confidence_100% (D)