Win32/Spy.Zbot.HU removal instruction

The Win32/Spy.Zbot.HU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

6-day free trial available.

What Win32/Spy.Zbot.HU virus can do?

Behavioural detection: Executable code extraction – unpacking
At least one process apparently crashed during execution
Creates RWX memory
CAPE extracted potentially suspicious content
Authenticode signature is invalid

How to determine Win32/Spy.Zbot.HU?


File Info:
name: 98B7948131BE319D4429.mlw
path: /opt/CAPEv2/storage/binaries/fdfb621903e96d3761fe6caad8fcc7dbe55d9bfe0639d0f2ca67f4c61973f3d9
crc32: 694AD69F
md5: 98b7948131be319d4429fd3df24c8462
sha1: 0d54603041dc049ea440cc9bfda6f45877cd2510
sha256: fdfb621903e96d3761fe6caad8fcc7dbe55d9bfe0639d0f2ca67f4c61973f3d9
sha512: 9250f9c591d7319280cc2981d94135bd8f27aecc65c1618a748c7398b3b1578da132393f5429eb7cd5cdfb2d2a84aec1a4e7a8d4d62b5d58802add4ec95c4707
ssdeep: 49152:QnDWNEMU160KartK7INV2gVtc5J5slSiNRLoQ:MWGUecUUbwz
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T15EA53341FE705477F65E8A7A9571B08E103BA6D9D03398F9366FAEAF100233EDD80925
sha3_384: 4da7b6f2f813c97b502c1db3cfc126d3c96f5f7cfd014dae205307f6e76ada7bb16a31a8543f378a6058e0e0a026162b
ep_bytes: e801000000c331f66a00ff1590104000
timestamp: 2008-02-11 12:33:18

Version Info:
0: [No Data]

Win32/Spy.Zbot.HU also known as:

Elastic	malicious (high confidence)
DrWeb	Trojan.PWS.Panda.117
MicroWorld-eScan	MemScan:Trojan.Spy.Zeus.C
FireEye	Generic.mg.98b7948131be319d
ALYac	MemScan:Trojan.Spy.Zeus.C
Cylance	Unsafe
Zillya	Trojan.Zbot.Win32.2875
Sangfor	Suspicious.Win32.Save.a
K7AntiVirus	Spyware ( 0058e0d01 )
K7GW	Spyware ( 0058e0d01 )
Cybereason	malicious.131be3
BitDefenderTheta	AI:Packer.C31817EA1E
VirIT	Trojan.Win32.ZBot.C
Cyren	W32/Zbot.M.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	Win32/Spy.Zbot.HU
TrendMicro-HouseCall	Mal_Zbot-3
ClamAV	Win.Trojan.Zbot-4430
Kaspersky	Trojan-Spy.Win32.Zbot.gen
BitDefender	MemScan:Trojan.Spy.Zeus.C
NANO-Antivirus	Trojan.Win32.Zbot.uucu
Avast	Win32:Zbot-BAI [Trj]
Ad-Aware	MemScan:Trojan.Spy.Zeus.C
Emsisoft	MemScan:Trojan.Spy.Zeus.C (B)
Comodo	TrojWare.Win32.Spy.Zbot.GEN@1fmlmy
VIPRE	Trojan-Spy.Win32.Zbot.gen (v)
TrendMicro	Mal_Zbot-3
McAfee-GW-Edition	BehavesLike.Win32.Generic.tc
Sophos	ML/PE-A + Mal/EncPk-CZ
Ikarus	Trojan-Spy.Zeus
Jiangmin	TrojanSpy.Zbot.flz
Avira	TR/Dropper.Gen
MAX	malware (ai score=85)
Antiy-AVL	Trojan[Spy]/Win32.Zbot
Microsoft	PWS:Win32/Zbot.G
ViRobot	Trojan.Win32.Zbot.66560.BG
ZoneAlarm	Trojan-Spy.Win32.Zbot.gen
GData	Win32.Trojan-Spy.Zbot.DT
Cynet	Malicious (score: 100)
AhnLab-V3	Worm/Win32.IRCBot.R33580
McAfee	PWS-Zbot.gen.i
VBA32	Malware-Cryptor.Win32.Vals.22
Malwarebytes	Malware.AI.1600065663
APEX	Malicious
Rising	Trojan.Spy.Win32.Zbot.fak (RDMK:cmRtazpj45IlAiAnh/80VB4c4hoG)
SentinelOne	Static AI – Malicious PE
Fortinet	W32/Zbot.gen!tr
AVG	Win32:Zbot-BAI [Trj]
CrowdStrike	win/malicious_confidence_90% (D)

How to remove Win32/Spy.Zbot.HU?

Win32/Spy.Zbot.HU removal tool

Download and install GridinSoft Anti-Malware.
Open GridinSoft Anti-Malware and perform a “Standard scan“.
“Move to quarantine” all items.
Open “Tools” tab – Press “Reset Browser Settings“.
Select proper browser and options – Click “Reset”.
Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment X