Updated version of this article is available on this link

twex.exe is added on your computer by a new variant of ZBot or zlob variant -
- a banking trojan that disables firewall,
- runs in the background and allows the hacker remote access to the infected system. steals sensitive financial data (credit card numbers, online banking login details), makes screen snapshots, downloads additional components. It has the characteristics of a Keylogger, Trojan Horse and a Backdoor.

The recently analyzed samples of this malware indicate that, this file twex.exe is located in C:\Windows\System32\twex.exe , and it creats a folder named C:\Windows\System32\twain32

The name twain32 is associated with a software that is used with scanners, therefore you need to make sure if the folder is a ligitimate one or not. If possible , delete the folder from that location, in case of a doubt of infection, and then reinstall the scanner's driver if you have the driver cd or the installation program. Until now, the information available indicate that, this virus creates twain32 folder only under C:\Windows\System32 folder.

the virus writers keep on changing the names/ locations of its files on the computer in order to avoid detection, therefore it will be helpful if you use the registry editor and open the Edit > Find box, and search for the filename "twex.exe" delete its entries.

This article gives you step by step instructions to remove the threat manually from your computer.

Aliases:     These are some of the aliases
          Trojan Horse [Symantec]
     Trojan-Spy.Win32.Zbot.ose [Kaspersky Lab]
     PWS:Win32/Zbot.gen!R [Microsoft]
     Trojan-Spy.Win32.Zbot [Ikarus]
     Win-Trojan/Zbot.70144.D [AhnLab]

If you are unable to open Task Manager
Sometimes you are not able to open the task manager, the run command etc. The virus does this. There are free tools to solve this problem.  They are listed here.  Click here to read more...

Delete folders/ files from the hard disk:
Delete the following folder if found
C:\Windows\System32\twain32

These are different places where twain.exe could be located
C:\Windows\System32\twain32.exe
C:\Windows\networkservice\twain32.exe
C:\Windows\twain32.exe

 (It will be useful to run a freeware temp files/ registry cleaner like CCleaner after deleting the above file. Click here to read more...)

 Delete the registry keys: by manually editing registry. You can edit the registry by using the windows built in registry editor. Click here to read more...

 These are the registry keys found in one infection. The infection of your computermay or may not be the same. So even if you do not find exactly same registry keys, you should find the files and the folder (mentioned beforehand) on an infected computer.

• The following Registry Keys were created:
  • HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7}
  • HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}
  • HKEY_USERS\.DEFAULT\Software\Microsoft\Protected Storage System Provider

• The newly created Registry Values are:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network]
    • UID = "%ComputerName%_00048AC7"
  • [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{19127AD2-394B-70F5-C650-B97867BAA1F7}]
    • {54DA3CE0-F090-3C13-C933-22A102DCA42E} = FF 09 F2 0D
    • {23343233-2C66-3B33-3432-343233343233} = FA 0A F4 0E
    • {94A73C77-34E2-9329-4A2D-D11633511DF1} = FD 09 F2 0D
    • {33323038-2829-5F2A-3039-333033333333} = F7 09 F2 0D
    • {1427B3BA-1099-AF5D-25A2-C7EF5A97F580} = FC 09 F2 0D
  • [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
    • ProxyEnable = 0x00000000
  • [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\{43BF8CD1-C5D5-2230-7BB2-98F22C2B7DC6}]
    • {33323038-2829-5F2A-3039-333033333333} = F7 09 F2 0D

• The following Registry Values were modified:
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    • Userinit = "%System%\userinit.exe,%System%\twex.exe,"
  
  so that twex.exe runs every time Windows starts
  
  • [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders]
    • Cookies = "%Profiles%\LocalService\Cookies"
    • History = "%Profiles%\LocalService\Local Settings\History"

 Using Firewall: It will be helpful if you have a firewall so that you can block the malicious communication of the malware.