About “Trojan.Win32.Shelma.tzs” infection

The Trojan.Win32.Shelma.tzs is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Win32.Shelma.tzs virus can do?

Creates RWX memory
The executable is compressed using UPX

How to determine Trojan.Win32.Shelma.tzs?


File Info:
crc32: A272CCED
md5: c33f62c2877366d97fdc0c15f57081a8
name: C33F62C2877366D97FDC0C15F57081A8.mlw
sha1: 3923052f90e4b5b7b1131f583552b42193a88d58
sha256: 1634500b2fa4e02f673576afa8b04ae29615afd3390826e3db180b189e7c922b
sha512: 850b3a045fcfc9f92cb2099e84485d8f4ca7598f10fe8a7b2c912209e77593041c9fc2d2eac507fddd0321b9e556a72a36dbd9ae2370fa2d7b75421c7819510b
ssdeep: 3072:VuwLd9tplZmgK860frRDMP7KchLOf7nDVF6PUp1YodLCz8yC/rNfv:ckPnZmdBeRYxOfzDVlvuzJg9
type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed

Version Info:
LegalCopyright: xa9 Microsoft Corporation. All rights reserved.
InternalName: Notepad
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
CompanyName: Microsoft Corporation
ProductName: Microsoftxae Windowsxae Operating System
ProductVersion: 6.1.7600.16385
FileDescription: Notepad
OriginalFilename: NOTEPAD.EXE
Translation: 0x0409 0x04b0

Trojan.Win32.Shelma.tzs also known as:

Bkav	W32.AIDetect.malware1
K7AntiVirus	Trojan ( 005376ae1 )
Elastic	malicious (high confidence)
DrWeb	Trojan.Swrort.1
Cynet	Malicious (score: 100)
ALYac	Backdoor.Shell.AC
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Alibaba	Trojan:Win32/Shelma.15d655b8
K7GW	Trojan ( 005376ae1 )
Cybereason	malicious.287736
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Rozena.ED
APEX	Malicious
Avast	Win32:Malware-gen
ClamAV	Win.Trojan.Swrort-5710536-0
Kaspersky	Trojan.Win32.Shelma.tzs
BitDefender	Backdoor.Shell.AC
NANO-Antivirus	Virus.Win32.Gen-Crypt.ccnc
MicroWorld-eScan	Backdoor.Shell.AC
Tencent	Win32.Trojan.Shelma.Svrb
Ad-Aware	Backdoor.Shell.AC
Sophos	Mal/Generic-S
Comodo	TrojWare.Win32.Rozena.A@4jwdqr
BitDefenderTheta	Gen:NN.ZexaF.34608.te0@aKf!YZni
VIPRE	Trojan.Win32.Swrort.B (v)
TrendMicro	BKDR_SWRORT.SM
McAfee-GW-Edition	BehavesLike.Win32.Virut.ft
FireEye	Generic.mg.c33f62c2877366d9
Emsisoft	Backdoor.Shell.AC (B)
SentinelOne	Static AI – Malicious PE
Avira	TR/Crypt.XPACK.Gen
Kingsoft	Win32.Hack.Undef.(kcloud)
Microsoft	Trojan:Win32/Leivion.I
AegisLab	Trojan.Win32.Shelma.4!c
GData	Backdoor.Shell.AC
Acronis	suspicious
McAfee	Swrort.f
MAX	malware (ai score=100)
Malwarebytes	Malware.Heuristic.1004
Panda	Trj/CI.A
TrendMicro-HouseCall	BKDR_SWRORT.SM
Rising	HackTool.Swrort!1.6477 (CLOUD)
Yandex	Trojan.Shelma!2zvk322XWkQ
Ikarus	Trojan.Win32.Rozena
Fortinet	W32/Swrort.C!tr
AVG	Win32:Malware-gen
Paloalto	generic.ml
Qihoo-360	Win32/Ransom.DogHousePower.HgIASOgA

How to remove Trojan.Win32.Shelma.tzs?

Trojan.Win32.Shelma.tzs removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X