Trojan-Spy.Win32.Zbot.aymu removal guide

The Trojan-Spy.Win32.Zbot.aymu is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan-Spy.Win32.Zbot.aymu virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Russian
• The binary contains an unknown PE section name indicative of packing
• The executable is compressed using UPX
• Authenticode signature is invalid

How to determine Trojan-Spy.Win32.Zbot.aymu?

File Info:
name: DD7D621DBA0028A91472.mlw
path: /opt/CAPEv2/storage/binaries/faa76d56c6e8f80876cca77d48b0feb2791e57879d26fb617ef38ab499fe2ba3
crc32: 74940164
md5: dd7d621dba0028a91472810250c98968
sha1: c0000076684171d51959895b94c363e0c723b505
sha256: faa76d56c6e8f80876cca77d48b0feb2791e57879d26fb617ef38ab499fe2ba3
sha512: 2f1da7fbeb579e300ff6fca181db4b15d080a579bac835adf051caa3c816618f6b5dec505a27c4caf327bb8f8124ee196901b652d98a7ee91ae47da81a7371c0
ssdeep: 3072:yo72iYd5XbdocDtiiJxGmr3wgTD8F9mqqzBZCZ4on4p8nYkaIC0r:naiC/ocDu+ggTymqqzH6YkaI
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15124CF05A1854B27D6B8A736FD43DE87A27D306535E54A1B13A24F04BEF362F7607322
sha3_384: 7f4d90972d391be0bc565c448b2b78a221d127a977ea4dd3938717e24612cd0dd7bd40e5e63e2426db20411eaf984aa8
ep_bytes: 558bec83c4f051ff75e48d4de051ff75
timestamp: 2008-08-19 16:28:49

Version Info:
0: [No Data]

Trojan-Spy.Win32.Zbot.aymu also known as:

How to remove Trojan-Spy.Win32.Zbot.aymu?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.