How to remove “Trojan:Win32/Zbot!pz”?

The Trojan:Win32/Zbot!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Trojan:Win32/Zbot!pz virus can do?

• Sample contains Overlay data
• Performs HTTP requests potentially not found in PCAP.
• Reads data out of its own binary image
• Drops a binary and executes it
• The binary contains an unknown PE section name indicative of packing
• Executable file is packed/obfuscated with MPRESS
• Authenticode signature is invalid
• Attempts to repeatedly call a single API many times in order to delay analysis time
• Attempts to modify proxy settings
• Yara rule detections observed from a process memory dump/dropped files/CAPE

How to determine Trojan:Win32/Zbot!pz?

File Info:
name: DD4FEBBA114944B9466E.mlw
path: /opt/CAPEv2/storage/binaries/ce486c2619d3b9ea152e0e0622ee765d5c99bfe819512736e462e17bf2a55909
crc32: A1CF3EAB
md5: dd4febba114944b9466e0ebd5b7e3830
sha1: 4f1cfc7674b139a68d1ed84712f2e2809e53635d
sha256: ce486c2619d3b9ea152e0e0622ee765d5c99bfe819512736e462e17bf2a55909
sha512: a0ce5d69aec330642c4b51f223b6367b7c1efbed93a25e38c9f2207deba595d77e124e8683eb35b4baf98b1031337b50a6bb8418a470d452fc1a37969d39a248
ssdeep: 768:T9ECL7YPvPfhBLCY5RRHV5GuUt9H+HRCVpNEIxfqymnb2+lduiF8x4:gDGuUYCVphxfH2bPlHFm4
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1EF73E2386ED55A76E37BDEB6C6F651C6F975B0233C02980D40DA43840823F66EDE1A1E
sha3_384: 776fff995f7c8c2571abc3026627161b7eb7688b4fd025cbe6de81cf85082e913dc55bb96e9ab94be2a420b0d2fa6a5f
ep_bytes: 558d6c248881ecd408000053565733db
timestamp: 2014-01-27 12:19:18

Version Info:
0: [No Data]

Trojan:Win32/Zbot!pz also known as:

How to remove Trojan:Win32/Zbot!pz?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.