What is “PWS:Win32/Zbot!V”?

The PWS:Win32/Zbot!V is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What PWS:Win32/Zbot!V virus can do?

At least one process apparently crashed during execution
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine PWS:Win32/Zbot!V?


File Info:
name: 787DD39411EA978BA4B4.mlw
path: /opt/CAPEv2/storage/binaries/d8649ae6bf5d22d1f74c091c1e5f239248b00dc00f2bb7621212c7268288bb3d
crc32: 0D4B9B41
md5: 787dd39411ea978ba4b48cf93f05f147
sha1: 1b957284e55f65c614bfd373b66016ac1456725f
sha256: d8649ae6bf5d22d1f74c091c1e5f239248b00dc00f2bb7621212c7268288bb3d
sha512: 8c7d6108049440fff287ce7523e729e6da0276093bc189b050a9ceae3ba21c8e637df103cce2a894ba20e113512b1b5ad1b9a9ffe36ee596b051fb51ea0cd8b3
ssdeep: 1536:rLawVX/txlthrxfBPElGNYv5TAQSU16GQ2j24oo:HawjxxLWAq6Yj24oo
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CAA3AF6DB5D12CF2C95419764640363367EEDD38252AAE53D380CF9B69AA0C2632DBC3
sha3_384: 6911d538010376afe3e05ec2b8d0c6e0a288dae511e174bdac35e9d86d73cee3061c5ec63368fb4dacaad528a03bbfc4
ep_bytes: c074058945f4eb17a1042b41000fb658
timestamp: 2008-07-15 03:19:48

Version Info:
0: [No Data]

PWS:Win32/Zbot!V also known as:

Bkav	W32.AIDetect.malware1
Lionic	Trojan.Win32.Generic.4!c
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.174983
FireEye	Generic.mg.787dd39411ea978b
ALYac	Gen:Variant.Graftor.174983
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Suspicious.Win32.Save.a
Alibaba	TrojanPSW:Win32/Generic.520a96b4
Cybereason	malicious.411ea9
VirIT	Trojan.Win32.Panda.EN
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Generik.MLXODPY
APEX	Malicious
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Gen:Variant.Graftor.174983
NANO-Antivirus	Trojan.Win32.Panda.cxmlzf
Avast	Sf:Zbot-CQ [Trj]
Tencent	Win32.Trojan.Generic.Aiin
Ad-Aware	Gen:Variant.Graftor.174983
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Spy.Zbot.ABW@1qnp50
DrWeb	Trojan.PWS.Panda.3349
Zillya	Trojan.Agent.Win32.424434
TrendMicro	TSPY_ZBOT.SMRL
McAfee-GW-Edition	BehavesLike.Win32.RAHack.nm
Emsisoft	Gen:Variant.Graftor.174983 (B)
Ikarus	Trojan-Spy.Zeus
GData	Gen:Variant.Graftor.174983
Jiangmin	Trojan/Generic.aqkzt
Antiy-AVL	Trojan[Spy]/Win32.Zbot
Kingsoft	Win32.Heur.KVMH015.a.(kcloud)
Gridinsoft	Ransom.Win32.Zbot.sa
Arcabit	Trojan.Graftor.D2AB87
ZoneAlarm	HEUR:Trojan.Win32.Generic
Microsoft	PWS:Win32/Zbot.gen!V
Acronis	suspicious
McAfee	Artemis!787DD39411EA
MAX	malware (ai score=98)
VBA32	TrojanPSW.Panda
Malwarebytes	Malware.AI.963678752
TrendMicro-HouseCall	TSPY_ZBOT.SMRL
Rising	Trojan.Generic!8.C3 (CLOUD)
SentinelOne	Static AI – Malicious PE
BitDefenderTheta	AI:Packer.219CE1AC1E
AVG	Sf:Zbot-CQ [Trj]
Panda	Trj/CI.A
CrowdStrike	win/malicious_confidence_90% (W)
MaxSecure	Trojan.Malware.300983.susgen

How to remove PWS:Win32/Zbot!V?

PWS:Win32/Zbot!V removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X