Trojan.ZbotPMF.S25692286 removal tips

The Trojan.ZbotPMF.S25692286 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan.ZbotPMF.S25692286 virus can do?

Sample contains Overlay data
The binary likely contains encrypted or compressed data.
Authenticode signature is invalid
Anomalous binary characteristics

How to determine Trojan.ZbotPMF.S25692286?


File Info:
name: 3486D7525F3B7114C3A8.mlw
path: /opt/CAPEv2/storage/binaries/b47b37711f61837a655e3da5ed5acc4575ff067e91d3eacc962a97b743edf6bf
crc32: 1109AB94
md5: 3486d7525f3b7114c3a83efa79b21638
sha1: 4c18b79f333c8a29c9af0592f05dce82985c71fc
sha256: b47b37711f61837a655e3da5ed5acc4575ff067e91d3eacc962a97b743edf6bf
sha512: 465fffdb1e763ce6ef778e7db5ab5041dab40186a9dec4618247b826aa0756f84eb3ce71f86830b534f2adffb64be657a29dea6cb8e814fcc1904fb255d42204
ssdeep: 3072:yKiRj7UTtVwgJ9jiO4L7p+r9qhAO1+BC3K5eqU+BC3K5eqYroG:2RjwT9x4np+JqhAOXK70K7
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1A9849E01B3C0DDB7F55926318477876206F9EC11A6A125AB178C3B1FDDB12A04A77F0B
sha3_384: 8924726b0064829ae78a83e67b6f96fd327909117041060342a2b2c1978ef1a335cb5196d63221a5553585f58ea1f83d
ep_bytes: d18b8580fdffff85c074088b10508b42
timestamp: 2013-03-05 08:54:29

Version Info:
0: [No Data]

Trojan.ZbotPMF.S25692286 also known as:

Bkav	W32.AIDetect.malware1
DrWeb	Trojan.Mods.146
MicroWorld-eScan	Gen:Variant.Ursu.713742
ClamAV	Win.Malware.Gepys-9770177-0
FireEye	Generic.mg.3486d7525f3b7114
CAT-QuickHeal	Trojan.ZbotPMF.S25692286
ALYac	Gen:Variant.Ursu.713742
Cylance	unsafe
VIPRE	Gen:Variant.Ursu.713742
Sangfor	Virus.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (W)
K7GW	Trojan ( 005690671 )
K7AntiVirus	Trojan ( 005690671 )
BitDefenderTheta	Gen:NN.ZexaF.36164.wuZ@aqrz3Ze
Cyren	W32/Kryptik.FYM.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
APEX	Malicious
Cynet	Malicious (score: 100)
BitDefender	Gen:Variant.Ursu.713742
Avast	Win32:Gepys-B [Trj]
TACHYON	Trojan/W32.Agent.372736.ALH
F-Secure	Heuristic.HEUR/AGEN.1317424
Baidu	Win32.Trojan-Dropper.Gepys.a
McAfee-GW-Edition	BehavesLike.Win32.Tool.fz
Trapmine	malicious.high.ml.score
Sophos	ML/PE-A
SentinelOne	Static AI – Malicious PE
Avira	HEUR/AGEN.1317424
Antiy-AVL	Trojan/Win32.Zbot
Xcitium	TrojWare.Win32.TrojanDropper.Gepys.AF@8lmpzb
Arcabit	Trojan.Ursu.DAE40E
GData	Gen:Variant.Ursu.713742
Google	Detected
AhnLab-V3	Trojan/Win32.Gepys.R290851
McAfee	GenericRXJB-GU!3486D7525F3B
MAX	malware (ai score=86)
Malwarebytes	Malware.AI.2006731523
Rising	Dropper.Gepys!8.15D (TFE:3:sfjrf2RXbYC)
Ikarus	Trojan-Dropper.Win32.Gepys
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/GenericKDZ.363C!tr
AVG	Win32:Gepys-B [Trj]
DeepInstinct	MALICIOUS

How to remove Trojan.ZbotPMF.S25692286?

Trojan.ZbotPMF.S25692286 removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X