Categories: Virus

Should I remove “Virus:Win32/Zbot.A”?

The Virus:Win32/Zbot.A is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Virus:Win32/Zbot.A virus can do?

  • Executable code extraction
  • Attempts to connect to a dead IP:Port (2 unique times)
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Reads data out of its own binary image
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Creates a slightly modified copy of itself
  • Attempts to modify Explorer settings to prevent hidden files from being displayed

Related domains:

ns2.epictureh.net

How to determine Virus:Win32/Zbot.A?


File Info:

crc32: 280DAC93md5: d5ebc1600f691a810a6ea7dd887802c3name: D5EBC1600F691A810A6EA7DD887802C3.mlwsha1: bf5e3422566f39067cfc8d2ea9b14cbb00df8b05sha256: 68b1a96f28663dd995c6c0b896d573ae7d3a9167466342ddd69247a56a3d3acdsha512: 4c97a85faf46431d7d99a6991a92473b93811cb14d371c72fcf43b1bd66861e0992e84dfe44e69a6a45f65099a50131b2be41ac2b338945f820d4206f568cdf6ssdeep: 768:/AIrCSfuYCF+xOF4/i/BEYkp7P6lweQDhDmpU5GFrrEzWsdSE0d8pUHIkI0Ibw:/dUYxO+2G40OIkabwtype: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

Translation: 0x0409 0x04b0InternalName: MHkwLmSZFileVersion: 1.21CompanyName: MHkwLmSZProductName: MHkwLmSZProductVersion: 1.21OriginalFilename: MHkwLmSZ.exe

Virus:Win32/Zbot.A also known as:

Bkav W32.AlterEIP.PE
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.Patched.FI
FireEye Generic.mg.d5ebc1600f691a81
CAT-QuickHeal Trojan.Patched.AM
ALYac Trojan.Patched.FI
Cylance Unsafe
VIPRE Virus.Win32.Zbot.a (v)
Sangfor Malware
K7AntiVirus Trojan ( 00133ee01 )
BitDefender Trojan.Patched.FI
K7GW Trojan ( 00133ee01 )
Cybereason malicious.00f691
Baidu Win32.Worm.Autorun.z
Cyren W32/Zbot.T.gen!Eldorado
Symantec W32.Changeup
TotalDefense Win32/SillyDl.SBW
APEX Malicious
Avast Win32:Zbodo [Inf]
ClamAV Win.Trojan.VB-1207
Kaspersky Trojan.Win32.ZbotPatched.a
NANO-Antivirus Virus.Win32.Dlder.lbyd
ViRobot Win32.PatchedZBot.A
Rising Worm.Agent!1.D162 (CLASSIC)
Ad-Aware Trojan.Patched.FI
TACHYON Trojan/W32.ZbotPatched.77824.B
Emsisoft Trojan.Patched.FI (B)
Comodo TrojWare.Win32.Patched.O@1mj32s
F-Secure Trojan:W32/Hutpic.gen!B
DrWeb Trojan.Siggen.34201
Zillya Virus.Starter.Win32.1
TrendMicro PE_ZBOT.A
McAfee-GW-Edition BehavesLike.Win32.VBObfus.lm
Sophos ML/PE-A + Troj/Zbot-NY
Ikarus Virus.Worm
Jiangmin TrojanDownloader.Genome.ghl
Avira TR/Patched.ZB
Antiy-AVL Worm/Win32.VBNA.a
Microsoft Virus:Win32/Zbot.A
Arcabit Trojan.Patched.FI
SUPERAntiSpyware Trojan.Agent/Gen-Vobfus
ZoneAlarm Trojan.Win32.ZbotPatched.a
GData Trojan.Patched.FI
Cynet Malicious (score: 100)
AhnLab-V3 Win-Trojan/Patched.AE
Acronis suspicious
McAfee VBObfus.b
MAX malware (ai score=85)
VBA32 TScope.Trojan.VB
Malwarebytes Generic.Trojan.Malicious.DDS
Panda W32/Patched.L
ESET-NOD32 Win32/TrojanDownloader.Small.OUC
TrendMicro-HouseCall PE_ZBOT.A
Tencent Trojan.Win32.Patched.k
Yandex Trojan.GenAsa!BuQA6xuGzUk
SentinelOne Static AI – Malicious PE
eGambit Unsafe.AI_Score_99%
Fortinet W32/VBObfus.BDBD!tr
BitDefenderTheta AI:Packer.7ED43E041F
AVG Win32:Zbodo [Inf]
CrowdStrike win/malicious_confidence_100% (D)
Qihoo-360 HEUR/QVM20.1.057B.Malware.Gen

How to remove Virus:Win32/Zbot.A?

  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.
Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Share
Published by
Paul Valéry

Recent Posts

Malware.AI.2099319323 information

The Malware.AI.2099319323 is considered dangerous by lots of security experts. When this infection is active,…

6 seconds ago

Backdoor.GenericFC.S20328115 removal guide

The Backdoor.GenericFC.S20328115 is considered dangerous by lots of security experts. When this infection is active,…

6 mins ago

How to remove “PWS:Win32/Lmir.JJ”?

The PWS:Win32/Lmir.JJ is considered dangerous by lots of security experts. When this infection is active,…

41 mins ago

Malware.AI.263066098 malicious file

The Malware.AI.263066098 is considered dangerous by lots of security experts. When this infection is active,…

56 mins ago

Buzus.8 removal guide

The Buzus.8 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago

Babar.438741 removal instruction

The Babar.438741 is considered dangerous by lots of security experts. When this infection is active,…

1 hour ago