Remove Trojan.Zbot


Trojan.Zbot also performs the following payload:

It will modify Windows Registry and add the following entries:

  • HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run\”userinit” = “%System%\sdra64.exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run\”userinit” = “%System%\oembios.exe”
  • HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Run\”userinit” = “%System%\ntos.exe”

Trojan.Zbot threat will drop the following malicious files:

  • %System%\sdra64.exe
  • %System%\oembios.exe
  • %System%\ntos.exe
  • %System%\wsnpoem\audio.dll
  • %System%\wsnpoem\video.dll
  • %System%\sysproc64\sysproc86.sys
  • %System%\sysproc64\sysproc32.sys
  • %System%\lowsec\local.ds

Leave a Comment