What is “TrojanPWS.Zbot.GO4”?

The TrojanPWS.Zbot.GO4 is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanPWS.Zbot.GO4 virus can do?

• Yara rule detections observed from a process memory dump/dropped files/CAPE
• Creates RWX memory
• Possible date expiration check, exits too soon after checking local time
• Anomalous file deletion behavior detected (10+)
• Dynamic (imported) function loading detected
• Reads data out of its own binary image
• A process created a hidden window
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• Authenticode signature is invalid
• Created a process from a suspicious location

How to determine TrojanPWS.Zbot.GO4?

File Info:
name: 0217FFFD1086F082B05E.mlw
path: /opt/CAPEv2/storage/binaries/d79c84611d7ef9bd8f567bd36a6207a2047986ab9a1764ba8f3d31a88ed03314
crc32: C0157601
md5: 0217fffd1086f082b05e33e8f31ab852
sha1: a6662e48ba5e3b2e49efb3095dce679586f1cc66
sha256: d79c84611d7ef9bd8f567bd36a6207a2047986ab9a1764ba8f3d31a88ed03314
sha512: ed7fa86ca3770b7f94a9fbff23242c4b35cde4d1a23418bc0d39bbc84d000e8edf75ad10a8889a5d726d1107d6e3d8b214aa87fe1a3e3126c713048e81f9af87
ssdeep: 1536:9U9YkETRm/CQTN7igW58kS7DYTjipvF22ta0:6zwR4BTN7258kkYvQd2U
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T150833A397AC44476D2BB863570B584D2697EBC233DAC055F39DA338E0CF2E629C2560E
sha3_384: d32e08ba02b36df1fe8e0f43687b3cb4a13e03d17ee185ecc598ab9ee824110d2d3c727d126cdb204c3907679e29b910
ep_bytes: 558bec6aff68a854400068c82a400064
timestamp: 2014-05-20 04:38:08

Version Info:
0: [No Data]

TrojanPWS.Zbot.GO4 also known as:

How to remove TrojanPWS.Zbot.GO4?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.