Trojan.Zbot.VXGen removal guide

The Trojan.Zbot.VXGen is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan.Zbot.VXGen virus can do?

• Behavioural detection: Executable code extraction – unpacking
• SetUnhandledExceptionFilter detected (possible anti-debug)
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Mimics the system’s user agent string for its own requests
• Dynamic (imported) function loading detected
• Performs HTTP requests potentially not found in PCAP.
• Starts servers listening on 0.0.0.0:22980, :0
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Uses Windows utilities for basic functionality
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Code injection with CreateRemoteThread in a remote process
• Deletes its original binary from disk
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• Created a process from a suspicious location
• Installs itself for autorun at Windows startup
• Attempts to modify proxy settings
• Collects information to fingerprint the system
• Anomalous binary characteristics

How to determine Trojan.Zbot.VXGen?

File Info:
name: F6C3E790FE6F3E649094.mlw
path: /opt/CAPEv2/storage/binaries/38ae3580635f6fadfdf3b25dec11650151f8e41b00218189a2de1fd33a2b8b73
crc32: A1926771
md5: f6c3e790fe6f3e64909453e8dd7b7fac
sha1: d66d5a9cd1685359e841e337eda29f594f207fc8
sha256: 38ae3580635f6fadfdf3b25dec11650151f8e41b00218189a2de1fd33a2b8b73
sha512: c18b3bca06e84022da15d6e8fc9c1f070fb2e70791e6690af7b8339be21797d4760a7e392cd7b1fb04cbedd16ffd13eb8d922109247ea203bf73d4054a47390b
ssdeep: 6144:txtPFM3idRGdGhKlBBfJjNxYEljjeRkisJ:txtFgiFGBNFlAa
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1C144481C5B7D4C2EC354B6BDCFB19CE6B338691620637A2A4F4BF3155339E4224862E9
sha3_384: dc8196150b79c86f9451596096907aba6af6040ecdb161b4922a1db9c98a32e8feea09befd3604a4c57c17ee7de55fd6
ep_bytes: 68a8fa4200e8f0ffffff000000000000
timestamp: 2014-11-03 18:39:37

Version Info:
Translation: 0x0409 0x04b0
Comments: Bruchflächen1
CompanyName: FileZilla Project
ProductName: Riesenproblemen2
FileVersion: 8.03.0006
ProductVersion: 8.03.0006
InternalName: Mikrokarten6
OriginalFilename: Mikrokarten6.exe

Trojan.Zbot.VXGen also known as:

How to remove Trojan.Zbot.VXGen?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.