Should I block it?
90% of PCs block this file from running.
Possible reason:
Multiple malware detections
Relationships
Parent process
Child process
zbezjservice.exe
| MD5: | 5b96ce469563263b738f319e827db820 |
| SHA1: | 961076351ca5e653d67c17cc346708b702d58afa |
| SHA256: | ed7610dff0fa20d8b9bcc94d8aad2902b758ad7d4345d9967211d458fd213a55 |
Warning 7 antivirus scanners has detected malware.
Overview
zbezjservice.exe is malware that executes as a process under the SYSTEM account with extensive privileges (the system and the administrator accounts have the same file privileges) typically within the context of its parent
srvany.exe. This particular version is usually found on Windows 8 Enterprise (6.2.9200.0).
Details
| File name: | zbezjservice.exe |
| Typical file path: | C:\windows\zbezjservice.exe |
| Size: | 286 KB (292,864 bytes) |
| Build date: | 3/23/2013 6:37 AM |
| Digital DNA |
| File packed: | No |
| .NET CLR: | No |
More details
Malware detections
Based on 40+ industry antivirus scanners, 7 of them detected the following malware.
| Antivirus engine | Engine version | Detection |
| Baidu Antivirus |
3.5.1.41473 |
Trojan.Win32.Agent.peo |
| ESET NOD32 |
7.8796 |
probably a variant of Win32/HackTool.KMSAuto.A |
| McAfee |
5.600.1067 |
Artemis!5B96CE469563 |
| McAfee Gateway Anti-Malware |
v2013-dat |
Artemis!5B96CE469563 |
| Symantec |
20131.1.5.61 |
WS.Reputation.1 |
| Trend Micro HouseCall |
9.700.0.1001 |
TROJ_GEN.F47V0323 |
| ViRobot |
2011.4.7.4223 |
Trojan.Win32.A.Inject.292864.J |
Resource utilization
(Note: statistics below are averages based on a minimum sample size of 200 unique participants)
Averages
| CPU |
| Total CPU: | 0.00000750% | |
| Kernel CPU: | 0.00000750% | |
| Kernel CPU time: | 16 ms/min | |
| Memory |
| Private memory: | 1.11 MB | |
| Private (maximum): | 3.82 MB | |
| Private (minimum): | 220 KB | |
| Non-paged memory: | 1.11 MB | |
| Virtual memory: | 20.89 MB | |
| Virtual memory (peak): | 23.41 MB | |
| Working set: | 292 KB | |
| Working set (peak): | 3.83 MB | |
| Resource allocations |
| Threads: | 3 | |
| Handles: | 57 | |
Process properties
| Integrety level: | System |
| Platform: | 64-bit |
| Command line: | C:\windows\zbezjservice.exe defaultport randomkmspid 43200 43200 killprocessonport |
| Owner: | SYSTEM |
| Parent process: | srvany.exe |
Distribution by Windows OS
| OS version | distribution |
| Windows 8 Enterprise |
100.00% |
|
Distribution by PC manufacturer
| PC Manufacturer | distribution |
| Acer |
100.00% |
|
