What is “Trojan.Zbot.IQA”?

The Trojan.Zbot.IQA is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.Zbot.IQA virus can do?

The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan.Zbot.IQA?


File Info:
name: BADA5A279B8EBEB6790E.mlw
path: /opt/CAPEv2/storage/binaries/16cdf39baf416a99f242d6469f2ebed5029d850c48671dc78b14895f9d735f88
crc32: E73CC1D0
md5: bada5a279b8ebeb6790e13efb64f0c66
sha1: fc4efebb068b97b5a8d72cc053b6200e31a3192e
sha256: 16cdf39baf416a99f242d6469f2ebed5029d850c48671dc78b14895f9d735f88
sha512: f97edcd63ca42ee34ab6d03b3920920f4731f48a1119a483761ca8088de9492383557ff023fb645366404e3d9bc9121d789754c544d21e2df9a41d3305897d87
ssdeep: 96:krppc56XnfEbBcOF7DsbwLc7ocJoq8ZlAqB2AWR6fqTPqa9F0IbfLl8UzUdPoijX:wpcsM1sbwALk5WR6fqTPqaExdBZBev
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T13363933A29664BE2CA28C5F5A5F45AECF25C9EB443E564CB43543C30A3747C36B3124D
sha3_384: a0b47ecc554e6ed478c8613bbe57b4fdf4e19b34f08ddfecaab1786e5dc4f66c4350784a00493027e380d8d83df385b8
ep_bytes: 908bec6a9068186b400068c030400064
timestamp: 2015-07-20 15:18:35

Version Info:
0: [No Data]

Trojan.Zbot.IQA also known as:

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.Zbot.IQA
FireEye	Generic.mg.bada5a279b8ebeb6
McAfee	PWSZbot-FAKV!BADA5A279B8E
Malwarebytes	Malware.Heuristic.1001
Sangfor	Suspicious.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (D)
Arcabit	Trojan.Zbot.IQA
Cyren	W32/Damaged_File.E.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
APEX	Malicious
Avast	Win32:Evo-gen [Susp]
Kaspersky	VHO:Backdoor.Win32.Hlux.gen
BitDefender	Trojan.Zbot.IQA
NANO-Antivirus	Trojan.Win32.Mods.dvbbeo
Ad-Aware	Trojan.Zbot.IQA
Emsisoft	Trojan.Zbot.IQA (B)
Comodo	TrojWare.Win32.Spy.Zbot.BNM@60owbz
F-Secure	Trojan.TR/Spy.Zbot.xbboqj
DrWeb	BackDoor.Siggen.59606
McAfee-GW-Edition	PWSZbot-FAKV!BADA5A279B8E
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
Jiangmin	Trojan/Generic.bhrqx
Avira	TR/Spy.Zbot.xbboqj
GData	Trojan.Zbot.IQA
Cynet	Malicious (score: 100)
BitDefenderTheta	AI:Packer.B58912C21B
ALYac	Trojan.Zbot.IQA
MAX	malware (ai score=85)
Rising	Trojan.Generic@AI.94 (RDML:Vo9t5updM3yDNZyf2xGwNg)
SentinelOne	Static AI – Suspicious PE
Fortinet	W32/Injector.CGOP!tr
AVG	Win32:Evo-gen [Susp]
Cybereason	malicious.79b8eb

How to remove Trojan.Zbot.IQA?

Trojan.Zbot.IQA removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X