Trojan:Win32/Zbot!pz removal instruction

The Trojan:Win32/Zbot!pz is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Trojan:Win32/Zbot!pz virus can do?

Sample contains Overlay data
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Trojan:Win32/Zbot!pz?


File Info:
name: 1C55B833C130B663EBA7.mlw
path: /opt/CAPEv2/storage/binaries/3d16234f337abf5143a37a3aa91c0dc7cecebd15e9b822a96f11ffbc64c1b284
crc32: BBAA6798
md5: 1c55b833c130b663eba7eb1fe42b1872
sha1: 5ba56ee75f6cd2303b31bf92ec702d49c26bb483
sha256: 3d16234f337abf5143a37a3aa91c0dc7cecebd15e9b822a96f11ffbc64c1b284
sha512: c667c769ea8afe87bf60a2080543296ad6960728180e2dcd18c84f472deb20bd05caa66f0c921e54fe2289052a6fc86eb34839b5f961bfa7d61955c5b670a922
ssdeep: 3072:bEVkH4ATRtqdEY82XLT79O6W/0aC0VrETTrDFzH3Pd:1ptqqY82X3RObR4frxz/d
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1AAD3AE427385EC87E0590A708853CBB94BE5FC70DBA147A337D46F5FACB62909932B16
sha3_384: 4665d4c4e4e81453b54d6a1862d350ddff29d5880aedc3a39d80a4fa63923b56f4c1d0228c5618d29dd164a0f019046d
ep_bytes: 00000000000000000000000000000000
timestamp: 2013-05-22 12:53:50

Version Info:
0: [No Data]

Trojan:Win32/Zbot!pz also known as:

Bkav	W32.AIDetectMalware
FireEye	Generic.mg.1c55b833c130b663
Skyhigh	BehavesLike.Win32.Generic.ch
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Riskware ( 00584baa1 )
K7GW	Riskware ( 00584baa1 )
Cybereason	malicious.75f6cd
Baidu	Win32.Trojan.Inject.ag
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
APEX	Malicious
Avast	Win32:Downloader-TJC [Trj]
F-Secure	Trojan.TR/Patched.Ren.Gen
DrWeb	Trojan.PackedENT.24720
TrendMicro	TROJ_GEN.R03BC0DAN24
Sophos	ML/PE-A
Jiangmin	Trojan/ShipUp.oi
Avira	TR/Patched.Ren.Gen
Antiy-AVL	Trojan[Dropper]/Win32.Gepys
Kingsoft	malware.kb.a.996
Xcitium	TrojWare.Win32.Kryptik.BBQP@4yhysc
Microsoft	Trojan:Win32/Zbot!pz
GData	Win32.Trojan.Agent.IH9444
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R03BC0DAN24
Rising	Trojan.Generic@AI.100 (RDML:jTLJMONZCUys1ysy/4/KXQ)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.94721794.susgen
Fortinet	W32/PossibleThreat
AVG	Win32:Downloader-TJC [Trj]
DeepInstinct	MALICIOUS
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Trojan:Win32/Zbot!pz?

Trojan:Win32/Zbot!pz removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X