Spy Worm

Worm:Win32/Spybot removal tips

Malware Removal

The Worm:Win32/Spybot is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware - Review 2020

GridinSoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend to use GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the TRIAL period.
6-day free trial available.

What Worm:Win32/Spybot virus can do?

  • Authenticode signature is invalid
  • Creates a copy of itself

How to determine Worm:Win32/Spybot?


File Info:

name: 9426E5F001262C150DA2.mlw
path: /opt/CAPEv2/storage/binaries/00dd782a5abc56fc77d6f080de44071f337958e77d9341424eb76f49200dc924
crc32: A4CC0E3B
md5: 9426e5f001262c150da263759d3f2cab
sha1: 1e11821a18a2b34e01eecda461f6ea68447de5a6
sha256: 00dd782a5abc56fc77d6f080de44071f337958e77d9341424eb76f49200dc924
sha512: 6173d17e04f10495defc81d600ec8b72c86b2d47a6c82244aaf99d5a759f8c25b3e5dd80bcf750e0219bfce6801639540cb8126af53d838890b031bb82f71448
ssdeep: 1536:ep9t5eeZBDqfPQCf4FFLuZUX7pUbQoq873zbBBjXO1IK3hrDNljWb6S4/I/S:wlc8v/pUbQo97jbBBK1IChrDNlRS
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T1B0B36CA7B7A54832F062053650914F2ACF7DFF705E629482C79061CE5E4CAF27B2A74B
sha3_384: d88b0df89e138313873b9c17c6e8bf659ec63c7aedc66dae6ef2072fdada434dfb9925a77dc19694a3416c01c50aaa43
ep_bytes: 558bec6aff6860064100682cc5400064
timestamp: 2005-02-06 04:01:01

Version Info:

0: [No Data]

Worm:Win32/Spybot also known as:

BkavW32.AIDetect.malware2
LionicTrojan.Win32.SdBot.m!c
DrWebBackDoor.IRC.Sdbot.based
MicroWorld-eScanGeneric.Sdbot.1105B53F
FireEyeGeneric.mg.9426e5f001262c15
CAT-QuickHealBackdoor.Sdbot.S199419
ALYacGeneric.Sdbot.1105B53F
CylanceUnsafe
VIPREGeneric.Sdbot.1105B53F
Sangfor[ARMADILLO V1.71]
AlibabaBackdoor:Win32/SdBot.91383c96
Cybereasonmalicious.001262
BitDefenderThetaAI:Packer.F8CED4D01E
CyrenW32/IRCBot-based6_DET!Eldorado
SymantecW32.Randex.gen
Elasticmalicious (high confidence)
ESET-NOD32Win32/IRCBot.KV
TrendMicro-HouseCallWORM_SPYBOT.CCF
Paloaltogeneric.ml
ClamAVWin.Trojan.SdBot-108
KasperskyBackdoor.Win32.SdBot.wt
BitDefenderGeneric.Sdbot.1105B53F
NANO-AntivirusTrojan.Win32.SdBot.dfbmtd
AvastWin32:Agent-HSQ [Wrm]
RisingBackdoor.Rbot!1.662E (CLASSIC)
Ad-AwareGeneric.Sdbot.1105B53F
ComodoBackdoor.Win32.IRCBot.KV@2lzp
F-SecureBackdoor.BDS/SdBot.Q.Plus
TrendMicroWORM_SPYBOT.CCF
McAfee-GW-EditionBehavesLike.Win32.PWSZbot.ch
SentinelOneStatic AI – Malicious PE
SophosML/PE-A + W32/Sdbot-Gen
IkarusBackdoor.Win32.IRCBot
GDataGeneric.Sdbot.1105B53F
JiangminBackdoor/SdBot.fy
AviraBDS/SdBot.Q.Plus
ArcabitGeneric.Sdbot.1105B53F
ZoneAlarmBackdoor.Win32.SdBot.wt
MicrosoftWorm:Win32/Spybot
CynetMalicious (score: 100)
AhnLab-V3Win32/IRCBot.worm.Gen
McAfeeW32/Sdbot.worm.a
VBA32BScope.Backdoor.Win32.SdBot
MalwarebytesMalware.AI.3759848381
APEXMalicious
TencentBackdoor.Win32.Sdbot.wt
YandexTrojan.GenAsa!Yu50446I8Gk
MAXmalware (ai score=83)
MaxSecureTrojan.Malware.300983.susgen
FortinetW32/IRCBot.GNT!tr
AVGWin32:Agent-HSQ [Wrm]
PandaW32/Gaobot.gen.worm
CrowdStrikewin/malicious_confidence_90% (W)

How to remove Worm:Win32/Spybot?

Worm:Win32/Spybot removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment