[KB3538] What is Gameover Zeus and does ESET protect me from it?

• Your ESET product detects the threat Win32/TrojanDownloader.Necurs.A
• Your ESET product detects the threat Win32/Spy.zbot or Win32/Zeus
• Your ESET product detects a variant of the threat Win32/Filecoder

Does ESET protect me from GameOver Zeus?

Yes, ESET detects and blocks the different types of malware distributed by GameOver Zeus as Win32/Zeus, Spy.zbot, Win32/TrojanDownloader.Necurs.A and variants of Win32/Filecoder. To ensure the security of your system, make sure that your ESET product is receiving regular virus signature database updates.

What if I am not an ESET customer?

You can use the free ESET Online Scanner to scan your system for GameOver Zeus related threats. If threats are found, we recommend that you contact ESET Support Services to arrange cleaning for your system.

What is GameOver Zeus?

GameOver Zeus is a botnet, a network of computers used to spread malware with criminal intent. The GameOver Zeus botnet has been used to steal banking information from infected computers.

As of May 30th, 2014, US authorities have disabled the GameOver Zeus botnet, eliminating the malware's ability to perform monetary transactions against infected users. Authorities suspect that GameOver Zeus may become active again in as little as two weeks. For this reason, it is critical that you take action to ensure the security of your computer by removing all infections and installing up-to-date antivirus software as soon as possible.

What if my ESET product detects one of these infections?

Follow the steps below to remove any GameOver Zeus related malware from your computer:

1. Ensure that Necurs is not present, or is removed from your computer. How do I run the Win32/Necurs cleaner?
2. Run the ESET ZbotZRcleaner tool. How do I use the ESET ZbotZRcleaner tool to remove a Spy.zbot infection?
3. Perform a full system scan using the instructions from the article referenced in step 2. If no threats are detected, your system is clean. If your ESET product still detects malware, contact ESET Technical Support.

For more information on GameOver Zeus:

See our ESET blog post: GameOver Zeus and Cryptolocker: Law enforcement hits gang responsible