Categories: SpyTrojan

How to remove “Trojan.SpyEye.S (B)”?

The Trojan.SpyEye.S (B) is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Trojan.SpyEye.S (B) virus can do?

Injection with CreateRemoteThread in a remote process
Attempts to connect to a dead IP:Port (2 unique times)
Creates RWX memory
Mimics the system’s user agent string for its own requests
At least one IP Address, Domain, or File Name was found in a crypto call
Starts servers listening on 0.0.0.0:33755, :0
Expresses interest in specific running processes
Reads data out of its own binary image
Drops a binary and executes it
Uses Windows utilities for basic functionality
Code injection with CreateRemoteThread in a remote process
Tries to unhook or modify Windows functions monitored by Cuckoo
Creates or sets a registry key to a long series of bytes, possibly to store a binary or malware config
Steals private information from local Internet browsers
A system process is generating network traffic likely as a result of process injection
Installs itself for autorun at Windows startup
Creates Zeus (Banking Trojan) mutexes
Attempts to modify proxy settings
Attempts to modify browser security settings
Harvests credentials from local FTP client softwares
Attempts to interact with an Alternate Data Stream (ADS)
Creates a slightly modified copy of itself
Collects information to fingerprint the system
Clears web history

How to determine Trojan.SpyEye.S (B)?


File Info:
crc32: 558E5B4Emd5: 74102a61fd431fba6e618def3e4e281dname: bot.exesha1: 31a7329c1f87830cf578546f6808e0e7443abebcsha256: 373304df5ac9fda80320b9d46f7244425903ab64bb889a32106e9042d38d9ddesha512: 4f806858bc6bfb1eca933ec397a49974d824f3cd5ae9807fc76f77709fdd77cf2d2df2462c23e4ae3a9855f4f5810db4dc1a79a91805a6acbed07771ecbafcd5ssdeep: 3072:/caqyte6CV77snHLLxt6yaXOqdPNbnhW4IxZx5kCZuubFrhU1wKKrONmg:/caBtc77snHRJY7PNNW4IxZ7zbC0rONhtype: MS-DOS executable
Version Info:
0: [No Data]

Trojan.SpyEye.S (B) also known as:

Bkav	W32.AppdataUfmavLnr.Trojan
MicroWorld-eScan	Trojan.SpyEye.S
CMC	Trojan-Spy.Win32.Zbot!O
CAT-QuickHeal	Trojan.Zbot.MUE.AO4
McAfee	PWS-Zbot.gen.avh
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
K7AntiVirus	Spyware ( 0026999c1 )
K7GW	Spyware ( 00009b291 )
CrowdStrike	win/malicious_confidence_100% (D)
Invincea	heuristic
Baidu	Win32.Trojan.Zbot.a
F-Prot	W32/Zbot.BR.gen!Eldorado
Symantec	Trojan.Zbot!gen19
ESET-NOD32	Win32/Spy.Zbot.YW
APEX	Malicious
ClamAV	Win.Spyware.Zbot-1275
Kaspersky	Trojan-Spy.Win32.Zbot.bopd
BitDefender	Trojan.SpyEye.S
NANO-Antivirus	Trojan.Win32.Panda.dpuawp
ViRobot	Trojan.Win32.Zbot.141312.H
Rising	Stealer.Zbot!1.648A (CLASSIC)
Endgame	malicious (high confidence)
Emsisoft	Trojan.SpyEye.S (B)
Comodo	TrojWare.Win32.Spy.Zbot.BPOD@4vmcr7
F-Secure	Trojan-Spy:W32/Zbot.AVTH
DrWeb	Trojan.PWS.Panda.786
MaxSecure	Trojan.Malware.300983.susgen
TrendMicro	TSPY_ZBOT.SMJV
McAfee-GW-Edition	BehavesLike.Win32.PWSZbot.ch
Fortinet	W32/Zbot.YW!tr
Trapmine	malicious.high.ml.score
FireEye	Generic.mg.74102a61fd431fba
Sophos	Troj/PWS-BSF
SentinelOne	DFI – Malicious PE
Cyren	W32/Zbot.BR.gen!Eldorado
Jiangmin	Trojan/Invader.cfa
Webroot	W32.Rogue.Gen
Avira	TR/SPY.A.5678
MAX	malware (ai score=84)
Antiy-AVL	Trojan[Spy]/Win32.Zbot
Arcabit	Trojan.SpyEye.S
SUPERAntiSpyware	Trojan.Agent/Gen-Cryptor
ZoneAlarm	Trojan-Spy.Win32.Zbot.bopd
Microsoft	PWS:Win32/Zbot!CI
AhnLab-V3	Trojan/Win32.Zbot.R4880
Acronis	suspicious
VBA32	SScope.Trojan.FakeAV.01110
ALYac	Trojan.SpyEye.S
Ad-Aware	Trojan.SpyEye.S
Malwarebytes	Trojan.Zbot
Panda	Trj/WLT.A
Zoner	Trojan.Win32.36816
TrendMicro-HouseCall	TSPY_ZBOT.SMJV
Tencent	Trojan.Win32.Zbot.vv
Yandex	TrojanSpy.Zbot!m1tuldSmKhw
Ikarus	Trojan-Spy.Win32.Zbot
GData	Trojan.SpyEye.S
BitDefenderTheta	Gen:NN.ZexaF.31988.imX@a4Cv8Kp
AVG	Sf:Crypt-BT [Trj]
Cybereason	malicious.1fd431
Avast	Sf:Crypt-BT [Trj]
Qihoo-360	Trojan.Downloader.Win32.Needaye.A