Win32/Spy.Zbot.GW removal

The Win32/Spy.Zbot.GW is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.Zbot.GW virus can do?

At least one process apparently crashed during execution
The binary contains an unknown PE section name indicative of packing
Authenticode signature is invalid

How to determine Win32/Spy.Zbot.GW?


File Info:
name: 15FC3CAD89CB63EC2378.mlw
path: /opt/CAPEv2/storage/binaries/62f60e67177310d1ef14a2af9c2624f3310bd261c0bccfaa5903e7cf495fce59
crc32: 3F056C54
md5: 15fc3cad89cb63ec2378a1fc7d48acd5
sha1: c0bd0b169e53ffb3938972d2515227604393584f
sha256: 62f60e67177310d1ef14a2af9c2624f3310bd261c0bccfaa5903e7cf495fce59
sha512: f70d295444a8d4ad65709e79abd70972241a7051d3d616cfa2ddc3f8881f5e0bad24b97506dd81b98de31b3e16ae3cc857441782af8160de3d95081fe688683b
ssdeep: 1536:bhBaw/1r05QyOC/2zPapEx/bDFR6tCp2JqY6WTfqsM:3awpOQnz7x/2J95
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T18A739E7DBA902CF2D951197746603633AAFEEC3029366D9393D0CF8A69554C2631E7C3
sha3_384: f91362afe9a41daa19819e38d7f7a51633abd8926421a859e47afa014bef160ef651770ee0677068b979322d2cb7fe5d
ep_bytes: 558bec81ec40040000e8a60d0000e8e0
timestamp: 2008-09-08 02:12:50

Version Info:
0: [No Data]

Win32/Spy.Zbot.GW also known as:

Bkav	W32.AIDetect.malware2
tehtris	Generic.Malware
DrWeb	Trojan.PWS.Panda.117
MicroWorld-eScan	Trojan.Spy.Zeus.C
FireEye	Generic.mg.15fc3cad89cb63ec
CAT-QuickHeal	Trojanspy.Zbot.20720
McAfee	PWS-Zbot.gen.ct
Cylance	Unsafe
Zillya	Trojan.Zbot.Win32.2020
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Spyware ( 0007f6ad1 )
K7GW	Spyware ( 0007f6ad1 )
Cybereason	malicious.d89cb6
BitDefenderTheta	AI:Packer.3D4331BB1D
Cyren	W32/Agent.CC.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/Spy.Zbot.GW
APEX	Malicious
TrendMicro-HouseCall	TSPY_ZBOT.SMLF
ClamAV	Win.Trojan.Zbot-6645
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Trojan.Spy.Zeus.C
NANO-Antivirus	Trojan.Win32.Panda.ifgd
Avast	Sf:Zbot-CQ [Trj]
Ad-Aware	Trojan.Spy.Zeus.C
Emsisoft	Trojan.Spy.Zeus.C (B)
Comodo	TrojWare.Win32.TrojanSpy.Zbot.Gen@961o3
VIPRE	Trojan.Spy.Zeus.C
TrendMicro	TSPY_ZBOT.SMLF
McAfee-GW-Edition	PWS-Zbot.gen.ct
Trapmine	malicious.moderate.ml.score
Sophos	ML/PE-A
Ikarus	Trojan-Spy.Zeus
GData	Trojan.Spy.Zeus.C
Jiangmin	TrojanSpy.Zbot.gfk
Google	Detected
Avira	TR/Crypt.XPACK.Gen
Antiy-AVL	Trojan/Generic.ASMalwS.31
Arcabit	Trojan.Spy.Zeus.C
ViRobot	Trojan.Win32.A.Zbot.91502
Microsoft	PWS:Win32/Zbot.gen!R
Cynet	Malicious (score: 100)
AhnLab-V3	Win-Trojan/Zbot.Gen
VBA32	SScope.Trojan.Bofa
ALYac	Trojan.Spy.Zeus.C
MAX	malware (ai score=89)
Malwarebytes	Malware.AI.3651233395
Rising	Trojan.Generic@AI.90 (RDML:dL+/PPSgHGM/9bKNN16Pyg)
SentinelOne	Static AI – Malicious PE
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/Zbot.BCW!tr.bdr
AVG	Sf:Zbot-CQ [Trj]
CrowdStrike	win/malicious_confidence_100% (W)

How to remove Win32/Spy.Zbot.GW?

Win32/Spy.Zbot.GW removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X