About “PWS:Win32/Zbot!atmnm” infection

The PWS:Win32/Zbot!atmnm is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PWS:Win32/Zbot!atmnm virus can do?

Sample contains Overlay data
Authenticode signature is invalid
Creates Zeus (Banking Trojan) mutexes

How to determine PWS:Win32/Zbot!atmnm?


File Info:
name: 1B2CD52E5E8ACE391643.mlw
path: /opt/CAPEv2/storage/binaries/8985024cb147b7101d71be62e73e269473ff03d4f89e80171dce908d899edc36
crc32: 55AEEAF0
md5: 1b2cd52e5e8ace3916436050ec43b1b1
sha1: c37920f6a11b56e8a0c9a0097f94f79d92c0c538
sha256: 8985024cb147b7101d71be62e73e269473ff03d4f89e80171dce908d899edc36
sha512: 608d2d1a0dd615f3f5b316307533ac4ab3e8f9721e0d60e7ed522ff655f197efe7248183fa46fa39d3c538660e9c9c07a893e19ef850c4c094160349c26505f2
ssdeep: 1536:lBYL8mIvuYwmPt1opqIrYfLqT2VS41QgfpxtLpCzNHyWZIZaMj5WzmuKbS:lBk8mIvuEPGb02TaQgtLp5WyhWzJqS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T19EB3AE22E3E1817CF4B35A3246710767DFB67D21193A822EE6D24B590F326B1D536393
sha3_384: 84acc446d2bcbee01884dfd27ee64a2a03a6bb54f2066d1ede0c545e32dfdeb8a3e8f0da3bc10592d916491843e9c0e6
ep_bytes: 558bec81ec3804000053565733ff4757
timestamp: 2008-04-02 08:25:35

Version Info:
0: [No Data]

PWS:Win32/Zbot!atmnm also known as:

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
FireEye	Generic.mg.1b2cd52e5e8ace39
CAT-QuickHeal	Trojanpws.Zbot.29195
Cylance	unsafe
VIPRE	Dropped:Generic.Malware.SFMg.A28EF40E
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Spyware ( 000108081 )
K7GW	Spyware ( 000108081 )
Cybereason	malicious.e5e8ac
Cyren	W32/Zbot.BS.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/Spy.Agent.PZ
APEX	Malicious
ClamAV	Win.Malware.Zbot-9951822-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Dropped:Generic.Malware.SFMg.A28EF40E
NANO-Antivirus	Trojan.Win32.Agent.cvvyro
MicroWorld-eScan	Dropped:Generic.Malware.SFMg.A28EF40E
Avast	Win32:BankerX-gen [Trj]
Tencent	Malware.Win32.Gencirc.10beba6e
Sophos	Mal/Behav-010
F-Secure	Trojan.TR/Dropper.Gen
DrWeb	Trojan.DownLoader9.46698
TrendMicro	TROJ_ZBOT.SMUC
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Trapmine	malicious.moderate.ml.score
Emsisoft	Dropped:Generic.Malware.SFMg.A28EF40E (B)
Ikarus	Trojan-Downloader.Win32.Small
GData	Dropped:Generic.Malware.SFMg.A28EF40E
Avira	TR/Dropper.Gen
Antiy-AVL	Trojan[PSW]/Win32.Zbot
Arcabit	Generic.Malware.SFMg.A28EF40E
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Zbot!atmnm
AhnLab-V3	Win-Trojan/Hupe.Gen
Acronis	suspicious
BitDefenderTheta	AI:Packer.6D9389A21E
ALYac	Dropped:Generic.Malware.SFMg.A28EF40E
MAX	malware (ai score=83)
VBA32	Trojan.Inject.01376
Malwarebytes	Generic.Spyware.Stealer.DDS
Panda	Generic Malware
TrendMicro-HouseCall	TROJ_ZBOT.SMUC
Rising	Stealer.Zbot!8.109D7 (TFE:4:B7IyWuCXsYJ)
Yandex	Trojan.GenAsa!NoTYJPNe6OI
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Zbot.PZ!tr.spy
AVG	Win32:BankerX-gen [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (D)

How to remove PWS:Win32/Zbot!atmnm?

PWS:Win32/Zbot!atmnm removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X