PWS:Win32/Zbot.GA (file analysis)

The PWS:Win32/Zbot.GA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What PWS:Win32/Zbot.GA virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Creates RWX memory
• Dynamic (imported) function loading detected
• Enumerates running processes
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Installs itself for autorun at Windows startup
• Likely virus infection of existing system binary
• Creates Zeus (Banking Trojan) mutexes

How to determine PWS:Win32/Zbot.GA?

File Info:
name: 8F47CA5EC2D9C00AAA3C.mlw
path: /opt/CAPEv2/storage/binaries/918d6f8c0e86b1175c9f701c0fe8428841bb3a91b5a6a00ad4a069fb45643c7f
crc32: 63C843BE
md5: 8f47ca5ec2d9c00aaa3c55b4c4d3cfc2
sha1: 7adb6a7ac5855b68607732a28ba1516ba8c8a1fb
sha256: 918d6f8c0e86b1175c9f701c0fe8428841bb3a91b5a6a00ad4a069fb45643c7f
sha512: 647cea1db82c1422157638b64bc571c0d885c887a0f24ed7a09eaa7f93d9f5292c601b434f5ba38747243979ad89ca2a6ca1a2a2662c8ed72dd0fc6dee81a2e4
ssdeep: 768:mAqSlzmdUoA9eqVKmIt0YILAvPyMWttXj2870X3P76L1fiewRZlRQsy:mmmdUoQRKvtwLmyM2th70nD+twRhQsy
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T16B23F24E3E185DE1F9162677093ACB269231FBE449357295C068D0A84C1C778BF22FBA
sha3_384: 6645348ec6289a12e3b3c5f1b23659fc7549d892c0f5235d3c44fc5c6c6bbf7184d4dd70148113425532292df382ebec
ep_bytes: eb00508bc483ec30c744240a00000000
timestamp: 2001-05-27 05:57:55

Version Info:
0: [No Data]

PWS:Win32/Zbot.GA also known as:

How to remove PWS:Win32/Zbot.GA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.