Spy Trojan

How to remove “Trojan.Spy.ZBot.BA”?

Malware Removal

The Trojan.Spy.ZBot.BA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Trojan.Spy.ZBot.BA virus can do?

  • The binary contains an unknown PE section name indicative of packing
  • Authenticode signature is invalid

How to determine Trojan.Spy.ZBot.BA?


File Info:

name: F78836BA005A4830203F.mlw
path: /opt/CAPEv2/storage/binaries/3a1c30497d7b343639961220df8adcc82ff3115bf84a9d94c8ad46b0119b5fa0
crc32: 1D99ED96
md5: f78836ba005a4830203f9035b52f5987
sha1: db03242b81973495bf2285d7ac663919461b59cd
sha256: 3a1c30497d7b343639961220df8adcc82ff3115bf84a9d94c8ad46b0119b5fa0
sha512: 1ec6507d60b4d0ea50cc7de1927c42b8834ae7034b1e2abc7f1dec743045ef4dd2b5613276d7f6cd852bf2d2effcf9f4e2e04150640a8da087fc9cdd4538c62f
ssdeep: 768:XYhLvnwnbKpIQlvXjgrcxGvUxsn6sKkbk8IvxpXAe3IfOaLW/v5aSvrkbyZa1r2D:XYVvnSKeS8rc/S6+YJ+e3aLs5ahzoD
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A6038D9A3AE1C07AC96140B23767AF5777FED42211154C47C3306DE82D76A0AE62FE4B
sha3_384: 9a9751d52a6f0cc138437bf039d689915c8eaded16db89b0cec46ccd22ab44d5197458644a967f574783774aff777550
ep_bytes: 33f6bbad214100b883204100fe00403b
timestamp: 2006-04-07 12:45:07

Version Info:

0: [No Data]

Trojan.Spy.ZBot.BA also known as:

BkavW32.AIDetect.malware1
MicroWorld-eScanTrojan.Spy.ZBot.BA
FireEyeGeneric.mg.f78836ba005a4830
ALYacTrojan.Spy.ZBot.BA
CylanceUnsafe
VIPRETrojan.Spy.ZBot.BA
SangforSuspicious.Win32.Save.a
Cybereasonmalicious.a005a4
CyrenW32/Zbot.E.gen!Eldorado
SymantecTrojan.Zbot
Elasticmalicious (high confidence)
ESET-NOD32a variant of Win32/Spy.Agent.NES
ZonerProbably Heur.ExeHeaderL
APEXMalicious
CynetMalicious (score: 100)
KasperskyVHO:Trojan-Spy.Win32.Convagent.gen
BitDefenderTrojan.Spy.ZBot.BA
AvastSf:Zbot-JD [Trj]
RisingTrojan.Win32.Crypt.ac (CLASSIC)
Ad-AwareTrojan.Spy.ZBot.BA
TACHYONTrojan-Spy/W32.Convagent.40960
EmsisoftTrojan.Spy.ZBot.BA (B)
ComodoTrojWare.Win32.Spy.Zbot.ACA@1rkc1t
DrWebTrojan.PWS.Panda.8
TrendMicroMal_Pai-1
McAfee-GW-EditionBehavesLike.Win32.Generic.ph
Trapminemalicious.high.ml.score
SophosML/PE-A + Mal/Zbot-A
SentinelOneStatic AI – Malicious PE
JiangminWin32/Virut.bo
AviraTR/Crypt.XPACK.Gen
MicrosoftPWS:Win32/Bankrypt.gen
ArcabitTrojan.Spy.ZBot.BA
GDataTrojan.Spy.ZBot.BA
GoogleDetected
AhnLab-V3Trojan/Win32.Banker.R3575
McAfeeGenericRXAA-AA!F78836BA005A
MAXmalware (ai score=80)
VBA32Malware-Cryptor.General.3
MalwarebytesSpyware.Agent
TrendMicro-HouseCallMal_Pai-1
YandexTrojan.GenAsa!4hd4IKG1WuM
IkarusTrojan-Spy.Win32.Bancos.aam
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/Agent.NES!tr.spy
BitDefenderThetaAI:Packer.BB5265881D
AVGSf:Zbot-JD [Trj]
PandaMalicious Packer
CrowdStrikewin/malicious_confidence_90% (D)

How to remove Trojan.Spy.ZBot.BA?

Trojan.Spy.ZBot.BA removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment