Win32/Spy.Zbot.ADI removal guide

The Win32/Spy.Zbot.ADI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Spy.Zbot.ADI virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Spy.Zbot.ADI?


File Info:
crc32: 060049C8
md5: 8adbd19b2b3f164d6a381739f7cf0069
name: readme.exe
sha1: 140e562a99bece47a994d0950b18bf09ebeb7e06
sha256: db8418c5a9c4263a1fad85503e9d3c361d5285a8f544eb56d95a9072b6fbc376
sha512: 8726d5bbeee8acce668de53db689e5a19193641f1b8ff7d7d90cc142995b1d6f529e5a366f2eb16725146157b440466f170cb24e7373cb0a39eabd3768a3b891
ssdeep: 24576:wkG5BKUv8pEkdj8v6ijLQXE6Jfw8gBMjGQTPrpfYU7ID:KQiv6+LIJfw8mLQTNfYeID
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:
LegalCopyright: Copyright xa9CPUID. 1999 - 2014
InternalName: Cheer
CompanyName: CPUID
PrivateBuild: 6.1.3.2
LegalTrademarks: Copyright xa9CPUID. 1999 - 2014
Comments: Discerning Esrb Overturned People Camel Trubek
ProductName: Cheer
ProductVersion: 6.1.3.2
FileDescription: Discerning Esrb Overturned People Camel Trubek
OriginalFilename: Cheer
Translation: 0x0409 0x04b0

Win32/Spy.Zbot.ADI also known as:

MicroWorld-eScan	Trojan.GenericKD.33581234
FireEye	Generic.mg.8adbd19b2b3f164d
McAfee	Artemis!8ADBD19B2B3F
ALYac	Trojan.GenericKD.33581234
AegisLab	Trojan.Win32.Dropback.b!c
Sangfor	Malware
BitDefender	Trojan.GenericKD.33581234
BitDefenderTheta	Gen:NN.ZexaF.34104.ev0@au4dtHji
Symantec	Trojan Horse
ESET-NOD32	Win32/Spy.Zbot.ADI
APEX	Malicious
GData	Win32.Trojan.Agent.3XFOGI
Kaspersky	Trojan-Dropper.Win32.Dropback.mp
Rising	Spyware.Zbot!8.16B (CLOUD)
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.33581234 (B)
Arcabit	Trojan.Generic.D20068B2
ZoneAlarm	Trojan-Dropper.Win32.Dropback.mp
Microsoft	Trojan:Win32/Occamy.C
VBA32	BScope.Trojan.Khalesi
MAX	malware (ai score=82)
Ad-Aware	Trojan.GenericKD.33581234
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R03BH0CCV20
Tencent	Win32.Trojan-dropper.Dropback.Eehv
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_90%
Fortinet	W32/Dropback.DDQGUEA!tr
Webroot	W32.Malware.Gen
AVG	FileRepMalware
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.Dropper.6cf

How to remove Win32/Spy.Zbot.ADI?

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

Win32/Spy.Zbot.ADI removal guide