Trojan.Spy.Zbot.FNM removal tips

The Trojan.Spy.Zbot.FNM is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Spy.Zbot.FNM virus can do?

• Behavioural detection: Executable code extraction – unpacking
• Sample contains Overlay data
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Unconventionial language used in binary resources: Chinese
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Anomalous binary characteristics

How to determine Trojan.Spy.Zbot.FNM?

File Info:
name: 44ED75A680D9A0F151EF.mlw
path: /opt/CAPEv2/storage/binaries/dd1b42fee9f50cb5493a5730eb7e3b8d40233ce153e219ff3e23dad7b9b51186
crc32: D0D5EEA1
md5: 44ed75a680d9a0f151efc9d3ffea7a90
sha1: 0b2dcaa417b2589068d5d1de6a9603bbe1938019
sha256: dd1b42fee9f50cb5493a5730eb7e3b8d40233ce153e219ff3e23dad7b9b51186
sha512: f26b1f0ff59dd32bb36abd2dc5f9caa0e1aa4a414bd15e78421483eab959aabd61b17f1b68e62c452888e684910f105af3a514f6bd06db0234c269ce6efe77ee
ssdeep: 12288:j7WuFh+3yAV7LUEbCzauHIfmbSaBn4GrrvUNs:nWk+3yAV7dluHIfa4G3UK
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T11A942313134DE600F2B26730E89B7764405D288B3F37D66EA51B239FAB59B84F235726
sha3_384: ae9f1c69117113ef69b2efd18fe2bbb8d7139056c2d63d58f59964140f124bd53ec68c512b7d2e8ee6b20c4b21a4bbb2
ep_bytes: 558bec81ec14010000b936000000eb0a
timestamp: 2011-08-05 01:55:42

Version Info:
CompanyName: Masnesaft Corporation
FileDescription: Masnesaft Visual Studie 2010
FileVersion: 1.9.43074.5121 built by: SP1Rel
InternalName: devenv.exe
LegalCopyright: © Masnesaft Corporation. All rights reserved.
OriginalFilename: devenv.exe
ProductName: Masnesaft® Visual Studio® 2010
ProductVersion: 1.9.43074.5121
Translation: 0x0409 0x04b0

Trojan.Spy.Zbot.FNM also known as:

How to remove Trojan.Spy.Zbot.FNM?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.