PWS:Win32/Zbot.gen!Y

Posted: December 21, 2010

Threat Metric

The Threat Meter is a malware assessment that SpywareRemove.com's research team is able to give every identifiable malware threat. Our Threat Meter includes several criteria based off of specific malware threats to value their severity, reach and volume. The Threat Meter is able to give you a numerical breakdown of each threat's initial Threat Level, Detection Count, Volume Count, Trend Path and Percentage Impact. The overall ranking of each threat in the Threat Meter is a basic breakdown of how all threats are ranked within our own extensive malware database. The scoring for each specific malware threat can be easily compared to other emerging threats to draw a contrast in its particular severity. The Threat Meter is a useful tool in the endeavor of seeking a solution to remove a threat or pursue additional analytical research for all types of computer users.

The following fields listed on the Threat Meter containing a specific value, are explained in detail below:

Threat Level: The threat level scale goes from 1 to 10 where 10 is the highest level of severity and 1 is the lowest level of severity. Each specific level is relative to the threat's consistent assessed behaviors collected from SpyHunter's risk assessment model.

Detection Count: The collective number of confirmed and suspected cases of a particular malware threat. The detection count is calculated from infected PCs retrieved from diagnostic and scan log reports generated by SpyHunter.

Volume Count: Similar to the detection count, the Volume Count is specifically based on the number of confirmed and suspected threats infecting systems on a daily basis. High volume counts usually represent a popular threat but may or may not have infected a large number of systems. High detection count threats could lay dormant and have a low volume count. Criteria for Volume Count is relative to a daily detection count.

Trend Path: The Trend Path, utilizing an up arrow, down arrow or equal symbol, represents the level of recent movement of a particular threat. Up arrows represent an increase, down arrows represent a decline and the equal symbol represent no change to a threat's recent movement.

% Impact (Last 7 Days): This demonstrates a 7-day period change in the frequency of a malware threat infecting PCs. The percentage impact correlates directly to the current Trend Path to determine a rise or decline in the percentage.

Threat Level:	8/10
Infected PCs:	728

First Seen:	January 13, 2011
Last Seen:	April 14, 2021
OS(es) Affected:	Windows

PWS:Win32/Zbot.gen!Y, also called W32/Zbot.YFP is a banker Trojan that attempts to steal passwords and other forms of confidential information that are related to online banking activities. As of December 2011, PWS:Win32/Zbot.gen!Y is a newly-developed variant of the well-known Zeus banker Trojan and is distributed by fake Adobe updates that are delivered in the form of e-mail file attachments. SpywareRemove.com malware research team notes that no reputable company, including Adobe, distributes software updates by using e-mail attachments like the ones that PWS:Win32/Zbot.gen!Y uses to install itself. Even though PWS:Win32/Zbot.gen!Y should be considered an extreme privacy and security threat to your PC, symptoms of a PWS:Win32/Zbot.gen!Y infection can be negligible, and you should use reputable anti-malware products to detect or remove PWS:Win32/Zbot.gen!Y whenever it's necessary to do so.

Keeping an Eye on This Adobe-Brand Fake-Out

PWS:Win32/Zbot.gen!Y e-mail messages can be identified by their inclusion of an 'AdobeSystems-Software_Critical Update Dec_2011-[Random numbers].zip' file attachment, within which lies the compressed executable for PWS:Win32/Zbot.gen!Y. Although e-mail spam that carries PWS:Win32/Zbot.gen!Y will pretend to be an important update for Acrobat Reader, no form of trustworthy company distributes software updates in this fashion, and these e-mail messages should be immediately-deleted to protect your PC from PWS:Win32/Zbot.gen!Y. Other signs of a PWS:Win32/Zbot.gen!Y-propagating e-mail include an 'Adobe Software Critical Upgrade Notification ID: M29MGJW7CN3' subject line and a faked 'Adobe Update Notification no-reply@adobe.com' sender address.

As long as you delete these e-mail messages as soon as you see them and avoid interaction with their file attachments, your PC should remain untouched by PWS:Win32/Zbot.gen!Y. However, if you do open this file attachment, PWS:Win32/Zbot.gen!Y will infect your computer and begin a series of attacks that are aimed at stealing private and bank-related information.

Observations on the Threats That PWS:Win32/Zbot.gen!Y Poses to Your Bank and Related Finances

As a Trojan, PWS:Win32/Zbot.gen!Y will attempt to avoid notice and may not show visible symptoms of being on your PC. However, risks that SpywareRemove.com malware experts have found to be associated with PWS:Win32/Zbot.gen!Y infections include:

Theft of personal information, such as account passwords, credit card numbers, PINs and other forms of identity or bank-related info. PWS:Win32/Zbot.gen!Y may scan files for cached information, monitor information that you enter from certain websites or record your keyboard input.
Loss of security with respect to your network ports and your firewall, both of which may be attacked to allow PWS:Win32/Zbot.gen!Y to send stolen information to remote criminals.
Accessibility problems with respect to anti-malware and security programs that could help you detect or delete PWS:Win32/Zbot.gen!Y.

If PWS:Win32/Zbot.gen!Y has infected your PC, you should strive to avoid entering unnecessary information until you've taken steps to find and remove PWS:Win32/Zbot.gen!Y with a good anti-malware application. You should also speak with a representative from your bank to prevent any possibility of fraud or undesired attacks on your bank account. Although PWS:Win32/Zbot.gen!Y is still a new PC threat as of December 2011, many types of PC security brands have identified and can combat PWS:Win32/Zbot.gen!Y infections with all due effectiveness. You may also see PWS:Win32/Zbot.gen!Y detected as PWS-Zbot.gen.hb.

Aliases

Trj/Spy.AB [Panda]PSW.Generic8.BFLK [AVG]W32/Zbot.AT!tr [Fortinet]Win-Trojan/Zbot.141824.AO [AhnLab-V3]Win32/Zbot.EGB [eTrust-Vet]Troj/PWS-BSF [Sophos]TR/Hijacker.Gen [AntiVir]Gen:Variant.Kazy.1779 [BitDefender]Trojan-Spy.Win32.Zbot.biwp [Kaspersky]Trojan.Spy.Zbot-142 [ClamAV]Win32.TRHijacker [eSafe]Win32:Fraudo [Trj] [Avast]W32/Zbot.BR.gen!Eldorado [F-Prot]PWS-Zbot.gen.ds [McAfee]TrojanSpy.Zbot.capz [CAT-QuickHeal]
More aliases (514)

Technical Details

File System Modifications

Tutorials: If you wish to learn how to remove malware components manually, you can read the tutorials on how to find malware, kill unwanted processes, remove malicious DLLs and delete other harmful files. Always be sure to back up your PC before making any changes.

The following files were created in the system:

%PROGRAMFILES%\Internet Download Manager\IDMan.exe

File name: IDMan.exe
Size: 897.28 KB (897280 bytes)
MD5: 5972f0615994e9a2b564c21c47599f16
Detection count: 94
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\Internet Download Manager
Group: Malware file
Last Updated: March 1, 2011

%SystemDrive%\Documents and Settings\Harvey Plante\Start Menu\Programs\Startup\efeho.exe

File name: efeho.exe
Size: 118.78 KB (118784 bytes)
MD5: d3d85d43f636a6af45f26b77ece99779
Detection count: 91
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\Harvey Plante\Start Menu\Programs\Startup
Group: Malware file
Last Updated: November 1, 2011

C:\WinApp\Clock Tray Skins_ORA\ClockTraySkins.exe

File name: ClockTraySkins.exe
Size: 1.33 MB (1330432 bytes)
MD5: a03d4b67795d68e95890764968d7bfdd
Detection count: 75
File type: Executable File
Mime Type: unknown/exe
Path: C:\WinApp\Clock Tray Skins_ORA\ClockTraySkins.exe
Group: Malware file
Last Updated: April 14, 2021

%WINDIR%\system32\windcd32.dll

File name: windcd32.dll
Size: 74.24 KB (74240 bytes)
MD5: 84aa1c3cbdf98d121990c4dd997d6834
Detection count: 35
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\system32
Group: Malware file
Last Updated: January 16, 2011

%SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup\esuf.exe

File name: esuf.exe
Size: 145.92 KB (145920 bytes)
MD5: 9dfe3d9a9c07c1fbe337ea6364be1b3a
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup
Group: Malware file
Last Updated: June 13, 2011

%SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup\ettori.exe

File name: ettori.exe
Size: 145.92 KB (145920 bytes)
MD5: 13286600b62779dcc885855cee33cbf9
Detection count: 33
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup
Group: Malware file
Last Updated: June 13, 2011

%USERPROFILE%\Start Menu\Programs\Startup\zybu.exe

File name: zybu.exe
Size: 153.6 KB (153600 bytes)
MD5: 76410d9afc8af1477280f92e5139e3d5
Detection count: 32
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Start Menu\Programs\Startup
Group: Malware file
Last Updated: January 13, 2011

%SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup\impu.exe

File name: impu.exe
Size: 144.38 KB (144384 bytes)
MD5: 6024d97573f3de5e4855f11a8b75f88f
Detection count: 28
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup
Group: Malware file
Last Updated: June 10, 2011

%SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup\ocso.exe

File name: ocso.exe
Size: 116.22 KB (116224 bytes)
MD5: 322b092be8945a19c2413bcf72f7a585
Detection count: 28
File type: Executable File
Mime Type: unknown/exe
Path: %SystemDrive%\Documents and Settings\Administrator\Start Menu\Programs\Startup
Group: Malware file
Last Updated: June 10, 2011

%USERPROFILE%\Start Menu\Programs\Startup\wwwrfd32.exe

File name: wwwrfd32.exe
Size: 21.5 KB (21504 bytes)
MD5: ba6fc51b94e3e62c23c21b974cac0bac
Detection count: 26
File type: Executable File
Mime Type: unknown/exe
Path: %USERPROFILE%\Start Menu\Programs\Startup
Group: Malware file
Last Updated: January 16, 2011

%WINDIR%\SysWow64\20578.dll

File name: 20578.dll
Size: 946.17 KB (946176 bytes)
MD5: a57deb949016484cea1c74bd6c21a4c0
Detection count: 11
File type: Dynamic link library
Mime Type: unknown/dll
Path: %WINDIR%\SysWow64
Group: Malware file
Last Updated: January 16, 2011

%WINDIR%\System32\drivers\pciide2k.sys

File name: pciide2k.sys
Size: 509.44 KB (509440 bytes)
MD5: 0f6c28d492d8baa532f6f3fa19f63b24
Detection count: 7
File type: System file
Mime Type: unknown/sys
Path: %WINDIR%\System32\drivers
Group: Malware file
Last Updated: July 30, 2012

%WINDIR%\system32\netsvcs32.exe

File name: netsvcs32.exe
Size: 694.27 KB (694272 bytes)
MD5: 61be5d4ad0cf138ec4190e8043d56fb2
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\system32
Group: Malware file
Last Updated: January 16, 2011

%WINDIR%\debugs\csrrsx.exe

File name: csrrsx.exe
Size: 305.15 KB (305152 bytes)
MD5: 931da0a3557c536ae94802a46cbb568d
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %WINDIR%\debugs
Group: Malware file
Last Updated: January 16, 2011

%LOCALAPPDATA%\eventCommonnet\compatWebaudio.dll

File name: compatWebaudio.dll
Size: 81.92 KB (81920 bytes)
MD5: ce2202273d534c307484bdb8edb818b3
Detection count: 5
File type: Dynamic link library
Mime Type: unknown/dll
Path: %LOCALAPPDATA%\eventCommonnet
Group: Malware file
Last Updated: January 16, 2011

%PROGRAMFILES%\messenge\Asdiph.exe

File name: Asdiph.exe
Size: 446.97 KB (446976 bytes)
MD5: 06cde1dfb914f0757a0c2d3ebcbf0164
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\messenge
Group: Malware file
Last Updated: January 16, 2011

%PROGRAMFILES%\ClickPotatoLite\bin\10.0.636.0\ClickPotatoLiteSA.exe

File name: ClickPotatoLiteSA.exe
Size: 741.68 KB (741680 bytes)
MD5: e7f93f7f99f8c9154b1fb6fee108d234
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %PROGRAMFILES%\ClickPotatoLite\bin\10.0.636.0
Group: Malware file
Last Updated: January 16, 2011

%APPDATA%\Boytys\paaw.exe

File name: paaw.exe
Size: 204.28 KB (204288 bytes)
MD5: 79e032ccdc5fafff28f85631f13e3689
Detection count: 5
File type: Executable File
Mime Type: unknown/exe
Path: %APPDATA%\Boytys
Group: Malware file
Last Updated: January 11, 2012

More files