Trojan.Spy.Zbot.FNZ removal

The Trojan.Spy.Zbot.FNZ is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Spy.Zbot.FNZ virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• Drops a binary and executes it
• Authenticode signature is invalid
• Created a process from a suspicious location
• Anomalous binary characteristics

How to determine Trojan.Spy.Zbot.FNZ?

File Info:
name: D468FB354BA891D9D9B1.mlw
path: /opt/CAPEv2/storage/binaries/55eca5e4bd53e513a3a4bc08332dd1e55b7c41496936da7dea9f99b8d347acca
crc32: 31CE596E
md5: d468fb354ba891d9d9b16a2e42c4d558
sha1: cf4dedf590473fb976a3a4e2fc121309c2600af6
sha256: 55eca5e4bd53e513a3a4bc08332dd1e55b7c41496936da7dea9f99b8d347acca
sha512: 4a0329595aede12c6e6f02354ee6d41ef4d48b782390981c99f92d284c557de6e7cae7a58cb387c985420e47d4975db44a2f5108ef6cac30e9b27946f2e3bbfb
ssdeep: 384:ZJtxTPUyMVhN8zDkB1mhLjggggggLvggggggggS03zq:HbYps/k/mFggggggLvggggggggS03zq
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1FCA2857117C10A90E6A31E769572620DA19CBF2323436ECF1A70F6854FF17D2A932669
sha3_384: 726c5aa00c41fd2fc707f6c720a0b09fee1b201985835186fc60d0a4d8872bbcbd4a874a8017a72b29086200651a459b
ep_bytes: 558bec6aff68a0324000680212400064
timestamp: 1994-04-22 20:19:25

Version Info:
CompanyName: Juice
FileDescription: Juice proged
FileVersion: Version 2.1.1
InternalName: Juice
LegalCopyright: Copyright by Sego© 
OriginalFilename: iJuice
Translation: 0x0409 0x04e3

Trojan.Spy.Zbot.FNZ also known as:

How to remove Trojan.Spy.Zbot.FNZ?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.