How to remove “TrojanDownloader:Win32/Zemot”?

The TrojanDownloader:Win32/Zemot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDownloader:Win32/Zemot virus can do?

• SetUnhandledExceptionFilter detected (possible anti-debug)
• Behavioural detection: Executable code extraction – unpacking
• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Guard pages use detected – possible anti-debugging.
• Dynamic (imported) function loading detected
• Enumerates running processes
• Reads data out of its own binary image
• CAPE extracted potentially suspicious content
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (Process Hollowing)
• Executed a process and injected code into it, probably while unpacking
• Behavioural detection: Injection (inter-process)
• Tries to unhook or modify Windows functions monitored by Cuckoo

How to determine TrojanDownloader:Win32/Zemot?

File Info:
name: 31832B7A54B98531F818.mlw
path: /opt/CAPEv2/storage/binaries/5f3d57ae5b91386a44b77272b2bab61de571148793b8baa847a0272dd84771b8
crc32: FF4B3CF2
md5: 31832b7a54b98531f818460227970c50
sha1: 4997dd16587501cbb81488ea4fc3661b5d4e8f62
sha256: 5f3d57ae5b91386a44b77272b2bab61de571148793b8baa847a0272dd84771b8
sha512: 9c356928daeed88d983b164f2bb63c218f97a83643665cd21ac59550d7d7ff2aa389455000fc521df0b84d08d2a2ab4b4d0b049cb93c503115e1abf23e5048e3
ssdeep: 6144:ci57sWa9FsJ4xIdOZoZ3DQc2VeqpacAK5blzJmmoxrXup4Xl4:cmsWsFK4CdOyZ3DQzeqpxjplNCrXusl4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1CD441260FBC98560C422157A0C32E260E735A7D6E6E3C78D79CF944D9EE36CC8D98312
sha3_384: 8be9051d7ef3b0bc9d5cde699851b1bc44a28afd79a4683a0df17059e00cec50df25e8777206852dba6d5d3de8eff1e5
ep_bytes: ff250020400000000000000000000000
timestamp: 2004-03-22 05:32:01

Version Info:
Translation: 0x0000 0x04b0
CompanyName: HampersCoveringExamples # DistributableDeclassified # ContortingHardback
FileDescription: DisposingEmbattleEffecting
FileVersion: 3.5.1.7
InternalName: ErasesCran.exe
LegalCopyright: ForayExterminates
LegalTrademarks: ConflagrationGeneticistEmperors
OriginalFilename: ErasesCran.exe
ProductName: EntreatingCyclic
ProductVersion: 3.5.1.7
Assembly Version: 1.3.6.3

TrojanDownloader:Win32/Zemot also known as:

How to remove TrojanDownloader:Win32/Zemot?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.