Trojan.Zbot.IVE removal tips

The Trojan.Zbot.IVE is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Zbot.IVE virus can do?

Executable code extraction
Injection (inter-process)
Injection (Process Hollowing)
Creates RWX memory
Possible date expiration check, exits too soon after checking local time
Attempts to connect to a dead IP:Port (5 unique times)
Reads data out of its own binary image
Unconventionial binary language: Chinese (Simplified)
Unconventionial language used in binary resources: Chinese (Simplified)
Executed a process and injected code into it, probably while unpacking
Steals private information from local Internet browsers
Exhibits behavior characteristic of Kelihos malware
Installs itself for autorun at Windows startup
Collects information about installed applications
Creates a hidden or system file
Attempts to access Bitcoin/ALTCoin wallets
Harvests credentials from local FTP client softwares
Installs WinPCAP

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Trojan.Zbot.IVE?


File Info:
crc32: 9B61716C
md5: 99b9039a72f4be225204e9b6b2290f64
name: 99B9039A72F4BE225204E9B6B2290F64.mlw
sha1: 7c0418896a1542eda8fdc30f1ee3ea6b9c6e779e
sha256: 15cb2fcc621e0c834c00b1ff26b4beec4bca8d5bd37e66555fd345e8015ed2b3
sha512: d9da791a2841f1e4c557b97b27b880ecebdd2133777eaa93222afb18fb4892693402e9b5847a56586070f5845685b6de79526fb5b61ac7d9c4d6b5e01a54c785
ssdeep: 24576:ggbS4ysU7fuNDXs+7SxVJe6/c3e4SdEElpm8cJz7jT0:JbSvPaTvS/JeZSdZfctjI
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: x7248x6743x6240x6709 (C) 1999
InternalName: ColorProcess
FileVersion: 1, 0, 0, 1
ProductName: ColorProcess x5e94x7528x7a0bx5e8fx9000
ProductVersion: 1, 0, 0, 1
FileDescription: ColorProcess Microsoft x57fax7840x7c7bx5e94x7528x7a0bx5e8f
OriginalFilename: ColorProcess.EXE
Translation: 0x0804 0x04b0

Trojan.Zbot.IVE also known as:

Bkav	W32.Common.5657FF8D
Elastic	malicious (high confidence)
DrWeb	BackDoor.Siggen2.1872
MicroWorld-eScan	Trojan.Zbot.IVE
FireEye	Generic.mg.99b9039a72f4be22
CAT-QuickHeal	Trojan.Generic.ZZ4
McAfee	GenericRXBC-EG!99B9039A72F4
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
Sangfor	Malware
K7AntiVirus	Trojan ( 005050f61 )
BitDefender	Trojan.Zbot.IVE
K7GW	Trojan ( 005050f61 )
Cybereason	malicious.a72f4b
BitDefenderTheta	Gen:NN.ZexaF.34804.cr3@auQGDseb
Cyren	W32/Kelihos.G.gen!Eldorado
Symantec	Trojan.Gen.2
Avast	Win32:Rootkit-gen [Rtk]
ClamAV	Win.Malware.Yakes-6981304-0
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.DLHB.elsgut
Tencent	Malware.Win32.Gencirc.10bbbb5a
Ad-Aware	Trojan.Zbot.IVE
Sophos	ML/PE-A + Troj/Kelihos-BL
Comodo	Malware@#1oy6594kaxt1u
F-Secure	Heuristic.HEUR/AGEN.1128858
Zillya	Trojan.Injector.Win32.470730
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Emsisoft	Trojan.Zbot.IVE (B)
Ikarus	Trojan.Win32.Injector
Jiangmin	Trojan.Yakes.uhf
Avira	HEUR/AGEN.1128858
MAX	malware (ai score=100)
Antiy-AVL	Trojan/Win32.TSGeneric
Microsoft	Backdoor:Win32/Kelihos
Arcabit	Trojan.Zbot.IVE
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	Trojan.Zbot.IVE
Cynet	Malicious (score: 100)
AhnLab-V3	Backdoor/Win32.Hlux.R196261
Acronis	suspicious
VBA32	Backdoor.Androm
ALYac	Trojan.Zbot.IVE
Malwarebytes	Generic.Trojan.Dropper.DDS
Panda	Trj/Genetic.gen
APEX	Malicious
ESET-NOD32	a variant of Win32/Injector.DLHB
Rising	Trojan.Injector!8.C4 (CLOUD)
Yandex	Trojan.Agent!snNVnCwwUbs
SentinelOne	Static AI – Malicious PE
eGambit	Unsafe.AI_Score_99%
Fortinet	W32/Injector.DMWL!tr
AVG	Win32:Rootkit-gen [Rtk]
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_100% (D)
Qihoo-360	Win32/Trojan.97a

How to remove Trojan.Zbot.IVE?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Trojan.Zbot.IVE removal tips