Troj/Zbot-FKA removal guide

The Troj/Zbot-FKA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Troj/Zbot-FKA virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Uses Windows utilities for basic functionality
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Performs a large number of encryption calls using the same key possibly indicative of ransomware file encryption behavior
• Collects information to fingerprint the system
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Troj/Zbot-FKA?

File Info:
name: 8C8F615E23F065CF2D7D.mlw
path: /opt/CAPEv2/storage/binaries/5fcce705c0e88749bc414cd9a02e0a9b4f3506b8afa03df16d7a12636d8921d7
crc32: AD4FA658
md5: 8c8f615e23f065cf2d7dc27d48482330
sha1: daa1b6b3f579c01bd0e5b2a19c00504ef4e00f96
sha256: 5fcce705c0e88749bc414cd9a02e0a9b4f3506b8afa03df16d7a12636d8921d7
sha512: a44e455cf52701e68abe9e17fdf58a6984fc3f35738b4b43ec60718b4aade159df637dedb2452105ccad0c1171d8d88dde0ca75bd31cdbd7f2f7886828f99a10
ssdeep: 6144:M021VSdqocMOC9hPbXeYZO8WYxAt9jygvMBpUQVtbhj+TUWEm:VvuWhPzZOTzjTvgpUGbt+0m
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EA5423CE814C9CBFF21B76F5AF934EC1B86F952144C6866AB1B5781D5C826E1FB01C88
sha3_384: 08a529b04f3b5b233ce57c6ee09d0161eb95987af8d88b6a8ef81174941880187ae8f6546a93e1ad4fb4e58d874a11f8
ep_bytes: bed4204000f81bc983ee6ead8bf0c1e6
timestamp: 2011-11-08 12:02:02

Version Info:
0: [No Data]

Troj/Zbot-FKA also known as:

How to remove Troj/Zbot-FKA?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.