Categories: Spy

Win32/Spy.Zbot.ADI removal guide

The Win32/Spy.Zbot.ADI is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Win32/Spy.Zbot.ADI virus can do?

Executable code extraction
Creates RWX memory
Reads data out of its own binary image
The binary likely contains encrypted or compressed data.
Attempts to repeatedly call a single API many times in order to delay analysis time

Related domains:

z.whorecord.xyz

a.tomx.xyz

How to determine Win32/Spy.Zbot.ADI?


File Info:
crc32: 060049C8md5: 8adbd19b2b3f164d6a381739f7cf0069name: readme.exesha1: 140e562a99bece47a994d0950b18bf09ebeb7e06sha256: db8418c5a9c4263a1fad85503e9d3c361d5285a8f544eb56d95a9072b6fbc376sha512: 8726d5bbeee8acce668de53db689e5a19193641f1b8ff7d7d90cc142995b1d6f529e5a366f2eb16725146157b440466f170cb24e7373cb0a39eabd3768a3b891ssdeep: 24576:wkG5BKUv8pEkdj8v6ijLQXE6Jfw8gBMjGQTPrpfYU7ID:KQiv6+LIJfw8mLQTNfYeIDtype: PE32 executable (GUI) Intel 80386, for MS Windows
Version Info:
LegalCopyright: Copyright xa9CPUID. 1999 - 2014InternalName: CheerCompanyName: CPUIDPrivateBuild: 6.1.3.2LegalTrademarks: Copyright xa9CPUID. 1999 - 2014Comments: Discerning Esrb Overturned People Camel TrubekProductName: CheerProductVersion: 6.1.3.2FileDescription: Discerning Esrb Overturned People Camel TrubekOriginalFilename: CheerTranslation: 0x0409 0x04b0

Win32/Spy.Zbot.ADI also known as:

MicroWorld-eScan	Trojan.GenericKD.33581234
FireEye	Generic.mg.8adbd19b2b3f164d
McAfee	Artemis!8ADBD19B2B3F
ALYac	Trojan.GenericKD.33581234
AegisLab	Trojan.Win32.Dropback.b!c
Sangfor	Malware
BitDefender	Trojan.GenericKD.33581234
BitDefenderTheta	Gen:NN.ZexaF.34104.ev0@au4dtHji
Symantec	Trojan Horse
ESET-NOD32	Win32/Spy.Zbot.ADI
APEX	Malicious
GData	Win32.Trojan.Agent.3XFOGI
Kaspersky	Trojan-Dropper.Win32.Dropback.mp
Rising	Spyware.Zbot!8.16B (CLOUD)
Endgame	malicious (high confidence)
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Dropper.tc
Trapmine	malicious.high.ml.score
Emsisoft	Trojan.GenericKD.33581234 (B)
Arcabit	Trojan.Generic.D20068B2
ZoneAlarm	Trojan-Dropper.Win32.Dropback.mp
Microsoft	Trojan:Win32/Occamy.C
VBA32	BScope.Trojan.Khalesi
MAX	malware (ai score=82)
Ad-Aware	Trojan.GenericKD.33581234
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R03BH0CCV20
Tencent	Win32.Trojan-dropper.Dropback.Eehv
SentinelOne	DFI – Malicious PE
eGambit	Unsafe.AI_Score_90%
Fortinet	W32/Dropback.DDQGUEA!tr
Webroot	W32.Malware.Gen
AVG	FileRepMalware
Paloalto	generic.ml
CrowdStrike	win/malicious_confidence_60% (W)
Qihoo-360	Win32/Trojan.Dropper.6cf