About “PWS:Win32/Zbot.AM” infection

The PWS:Win32/Zbot.AM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PWS:Win32/Zbot.AM virus can do?

How to determine PWS:Win32/Zbot.AM?


File Info:
crc32: 8E56F835
md5: 133a43efa0ea4b83c0cb6a1895d52012
name: 133A43EFA0EA4B83C0CB6A1895D52012.mlw
sha1: f9b5b87715a21f7e945f395d56cbefa37e964a02
sha256: a98ec831838beaa8086edbab8fdfe19924dbaac7e1684cbeb214e3fbf7f1c1a4
sha512: e598995d7e7e0c746b6cc68d7dab11741640404cae6a6006fe40659e1571884be0cbf28ac8e5829d72445eea97d3093c2023fccd7cdabfe90817e2148fd6d751
ssdeep: 12288:t43gthMWC0RvWs8iPIAWijuAHkTYOteov3T1U3A2IAogr:+3IjnRv78iQAW9AEbYovD1wVIAogr
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: (c) 2010 Booj
InternalName: climbSh.exe
FileVersion: 10.0.505.663
CompanyName: Booj
ProductName: About proper
ProductVersion: 10.0.505.663
FileDescription: About Spr
OriginalFilename: climbSh.exe
Translation: 0x0409 0x04e4

PWS:Win32/Zbot.AM also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Spyware ( 0055e3db1 )
DrWeb	Trojan.PWS.Panda.4379
MicroWorld-eScan	Gen:Variant.Symmi.37364
ALYac	Gen:Variant.Symmi.37364
Cylance	Unsafe
Zillya	Trojan.Blocker.Win32.12837
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
Alibaba	TrojanPSW:Win32/Generic.fc80328a
K7GW	Spyware ( 0055e3db1 )
Cybereason	malicious.fa0ea4
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Spy.Zbot.AAU
APEX	Malicious
Avast	Win32:Malware-gen
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Symmi.37364
NANO-Antivirus	Trojan.Win32.Panda.cuyojs
Tencent	Malware.Win32.Gencirc.114c4c0f
Ad-Aware	Gen:Variant.Symmi.37364
Sophos	Mal/Generic-R + Troj/Ransom-ADZ
Comodo	Malware@#1qlrs1zzus30a
F-Secure	Trojan.TR/Crypt.ZPACK.Gen2
BitDefenderTheta	Gen:NN.ZexaF.34738.Dq0@ai7Fa6pi
VIPRE	Trojan.Win32.Zbot.jr (v)
TrendMicro	TROJ_SPNR.14L313
McAfee-GW-Edition	Generic.enj
FireEye	Generic.mg.133a43efa0ea4b83
Emsisoft	Gen:Variant.Symmi.37364 (B)
SentinelOne	Static AI – Suspicious PE
Jiangmin	Trojan/Blocker.hif
Webroot	W32.Malware.Heur
Avira	TR/Crypt.ZPACK.Gen2
eGambit	Generic.Malware
Antiy-AVL	Trojan/Generic.ASMalwS.619677
Microsoft	PWS:Win32/Zbot.AM
AegisLab	Trojan.Win32.Zbot.lVvm
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Gen:Variant.Symmi.37364
TACHYON	Trojan/W32.Blocker.477696.D
AhnLab-V3	Trojan/Win32.Blocker.R91124
McAfee	Generic.enj
MAX	malware (ai score=100)
Panda	Trj/Genetic.gen
TrendMicro-HouseCall	TROJ_SPNR.14L313
Yandex	Trojan.Blocker!tLmhck0xTKM
Ikarus	Trojan.Crypt2
Fortinet	W32/Kryptik.PDB!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml

How to remove PWS:Win32/Zbot.AM?

PWS:Win32/Zbot.AM removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X