How to remove “PWS:Win32/Zbot!G”?

The PWS:Win32/Zbot!G is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PWS:Win32/Zbot!G virus can do?

At least one process apparently crashed during execution
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid

How to determine PWS:Win32/Zbot!G?


File Info:
name: FE041B55BB2838326CC7.mlw
path: /opt/CAPEv2/storage/binaries/f60722449db369c5b0e0e1473c47da3426dd5dcb395bd783dcc1e9169f1a55f8
crc32: 230B30E9
md5: fe041b55bb2838326cc7dae1a066ed32
sha1: cc0dd67b9a91d13c5ba21899d658847bae898527
sha256: f60722449db369c5b0e0e1473c47da3426dd5dcb395bd783dcc1e9169f1a55f8
sha512: 11562d810154fc2dd9182595bbf8062aa1bf4c86d49fde16ff847cd02f35a6ba1adbb69fee37dc33ccb1ee5a4ac42c6674d787441328d109d764470db689a751
ssdeep: 12288:H25iieHNGs0jXrgTNcLTG4eEKp0bAiisJIJamKkyGyrvGY0KdUoh:HgiiYNGPXScTGpEWELisEa5NrvDdUoh
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A4E42392539EC383D87548BE36AF3A14A0F33C474A17D727A7B14CC5D919A82625B33B
sha3_384: 7b2c26c51d0fe2fa702f978707d7ed2cd2f409cf3e67dc353051d541b2215ff0557c17954a5b4038dfbbb39ad6638a5f
ep_bytes: 81e8882ddf43b87fc8ffffc1c80781c7
timestamp: 2008-05-14 08:27:53

Version Info:
0: [No Data]

PWS:Win32/Zbot!G also known as:

Bkav	W32.AIDetect.malware2
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.FakeAlert.Gen.1
ALYac	Trojan.FakeAlert.Gen.1
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 0055e3da1 )
BitDefender	Trojan.FakeAlert.Gen.1
K7GW	Trojan-Downloader ( 0055e3da1 )
Cybereason	malicious.5bb283
Arcabit	Trojan.FakeAlert.Gen.1
Cyren	W32/Trojan.AWKM-6106
Symantec	ML.Attribute.HighConfidence
tehtris	Generic.Malware
ESET-NOD32	a variant of Win32/Kryptik.CVD
APEX	Malicious
ClamAV	Win.Trojan.Zbot-3295
Kaspersky	Packed.Win32.Katusha.a
NANO-Antivirus	Trojan.Win32.Zbot.upjd
Rising	Dropper.Generic!8.35E (CLOUD)
Ad-Aware	Trojan.FakeAlert.Gen.1
Sophos	ML/PE-A + Mal/EncPk-CZ
Comodo	MalCrypt.Indus!@1qrzi1
DrWeb	Trojan.Packed.569
Zillya	Trojan.Kryptik.Win32.251754
TrendMicro	Mal_FakeAV
McAfee-GW-Edition	BehavesLike.Win32.Generic.jc
FireEye	Generic.mg.fe041b55bb283832
Emsisoft	Trojan.FakeAlert.Gen.1 (B)
Ikarus	Trojan.Win32.FraudPack
Jiangmin	TrojanSpy.Zbot.abvh
Avira	TR/Dropper.Gen
Microsoft	PWS:Win32/Zbot.gen!G
GData	Trojan.FakeAlert.Gen.1
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Fraudpack.Gen
McAfee	RDN/Generic PWS.y
MAX	malware (ai score=81)
VBA32	Malware-Cryptor.General.2
Panda	Trj/CI.A
TrendMicro-HouseCall	Mal_FakeAV
Yandex	TrojanSpy.Zbot!zUHDGbgssOY
SentinelOne	Static AI – Malicious PE
Fortinet	W32/FraudPack.B!tr
BitDefenderTheta	AI:Packer.3FE0F7EA1A
AVG	Win32:Evo-gen [Susp]
Avast	Win32:Evo-gen [Susp]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove PWS:Win32/Zbot!G?

PWS:Win32/Zbot!G removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X