Malware

Win32:Zbot-PJM [Trj] removal

Malware Removal

The Win32:Zbot-PJM [Trj] is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Win32:Zbot-PJM [Trj] virus can do?

  • Injection (inter-process)
  • Injection (Process Hollowing)
  • Creates RWX memory
  • Reads data out of its own binary image
  • Unconventionial language used in binary resources: Arabic
  • The binary likely contains encrypted or compressed data.
  • Executed a process and injected code into it, probably while unpacking
  • Anomalous binary characteristics

Related domains:

z.whorecord.xyz
a.tomx.xyz

How to determine Win32:Zbot-PJM [Trj]?


File Info:

crc32: 7148A6D1
md5: 524dcd57319a72cd1d0dfbb0f6361900
name: 524DCD57319A72CD1D0DFBB0F6361900.mlw
sha1: da2a842ae602254022d214dc1bef4159448ae23d
sha256: 7cc81ff0af693c1c03979634f744717ca83e31fc18336fcd044771b5af248d8a
sha512: e31837a580422151607a5f95238c363d49c38ed603e4327a640fd0fc4354c65367a87261edaddda440b7fbc4590c06be24a71f74a6af88cc357d00418c306963
ssdeep: 6144:0GnWDxtF4wvuY5LBMqZjyXhb3hIlTGyUs+8BZwaIXw:0GWVtFhm49ZEOlSfP8Hbf
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Win32:Zbot-PJM [Trj] also known as:

K7AntiVirusTrojan ( 0040037e1 )
LionicTrojan.Win32.Generic.4!c
Elasticmalicious (high confidence)
DrWebTrojan.PWS.Panda.547
CynetMalicious (score: 100)
ALYacGen:Heur.Ransom.Cerber.2
CylanceUnsafe
ZillyaTrojan.Zbot.Win32.78770
SangforTrojan.Win32.Save.a
CrowdStrikewin/malicious_confidence_100% (D)
AlibabaTrojanSpy:Win32/Generic.fe269388
K7GWTrojan ( 0040037e1 )
Cybereasonmalicious.7319a7
CyrenW32/A-4f5634b0!Eldorado
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Spy.Zbot.AAQ
APEXMalicious
AvastWin32:Zbot-PJM [Trj]
ClamAVWin.Trojan.Agent-628117
KasperskyHEUR:Trojan.Win32.Generic
BitDefenderGen:Heur.Ransom.Cerber.2
NANO-AntivirusTrojan.Win32.Zbot.xoroh
MicroWorld-eScanGen:Heur.Ransom.Cerber.2
TencentWin32.Trojan.Dropper.bfej
Ad-AwareGen:Heur.Ransom.Cerber.2
SophosML/PE-A + Mal/Zbot-IB
ComodoMalware@#345812lwglozp
VIPRETrojan.Win32.Kryptik.alin (v)
McAfee-GW-EditionBehavesLike.Win32.Vundo.dc
FireEyeGeneric.mg.524dcd57319a72cd
EmsisoftGen:Heur.Ransom.Cerber.2 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan/Yakes.gai
WebrootTrojanspy:Win32/Fitmu.A
AviraTR/Dropper.Gen8
eGambitUnsafe.AI_Score_99%
Antiy-AVLTrojan/Generic.ASMalwS.2233F
MicrosoftPWS:Win32/Zbot
GDataGen:Heur.Ransom.Cerber.2
AhnLab-V3Trojan/Win32.Yakes.R35076
McAfeePWS-Zbot.gen.aly
MAXmalware (ai score=100)
VBA32Trojan.Yakes
MalwarebytesMalware.AI.763329815
PandaTrj/Sinowal.WWG
RisingTrojan.Generic@ML.89 (RDML:V3PnF4XgZFTIvjXId7JuNg)
YandexTrojan.GenAsa!CXjJZ4RfSgM
IkarusTrojan-PWS.Win32.Zbot
MaxSecureTrojan.Malware.7164915.susgen
FortinetW32/Injector.VWW!tr
AVGWin32:Zbot-PJM [Trj]
Paloaltogeneric.ml
Qihoo-360Win32/TrojanDropper.Generic.HxQBEpsA

How to remove Win32:Zbot-PJM [Trj]?

Win32:Zbot-PJM [Trj] removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment