Comments on: Win32.Zafi.B

By: admin

admin — Mon, 23 Mar 2009 15:27:56 +0000

attn. Mr. Nick
The only way is to install a good antivirus. My recommendation is to use Spyware Doctor. You cannot install it on your ill computer, so please transfer your hard disk to another machine. At that machine, you need to install Spyware Doctor in advance. My tip is to follow the link provided in this article, for it will let you get the copy of Spyware Doctor adjusted for functioning at the computers infected and probably already damaged by trojans, as well as to remove trojans like Win32.Zafi.B prior to any other rogues. Start scanning the infected hard disk with Spyware Doctor and follow the instruction of the program dialog box to remove Win32.Zafi.B.

By: nick

nick — Wed, 18 Mar 2009 19:43:50 +0000

My computer got struck by the Zafi.B a while ago and now, I can’t even get on the internet. It moves so slowly and every time i get on, it stops responding. I am using a different computer. Could someone tell me how to manually, using easier terms because I am not used to this, delete this thing?

Thanks,
Nick

By: anonymous

anonymous — Thu, 12 Feb 2009 07:57:48 +0000

Here’s what I did that seemed to work (however, Win32.Zafi.B seems to take a few different forms):

Run (WinKey+R) “msconfig” and look for a program out of the ordinary in the Startup tab.
End the process by Ctrl+Alt+Del (Task Manager).
Delete the Registry key listed in msconfig by running “regedit” and navigating to [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run].
(Mine listed
realteczs=”C:\Documents and Settings\~user name~\Application Data\Google\pfysw721318.exe 2″
Delete this file with Windows Explorer.

I’ve been having alerts supposedly from Windows Firewall. Also Internet Explorer and Mozilla Firefox would close after a few seconds.

“Security Center Alert
Name: Win32.Zafi.B
Risk Level: High
Description: Zafi.B is a worm trojan program that records keystrokes and takes screen shots of the computer, stealing personal financial information.” etc.

I installed AVG Free Edition 7.5 from http://www.oldapps.com/AVG_antivirus.php after reading reviews that 7.5 seemed to run faster or more efficiently than 8.0, and updated it.
AVG must’ve done something to let the web browsers work again.

One of the viruses it found and supposedly repaired was C:\Documents and Settings\~user name~\Application Data\Google\pfysw721318.exe
The date was recent on this file, and I know I didn’t download it. It also showed up in the registry. I’d found the path by running “msconfig” and looking at Startup. I think deleting this program and the registry key solved the problem.

By: kellum

kellum — Tue, 10 Feb 2009 05:33:31 +0000

same problem. zafi wont let me even use the links to remove it…. fuck.

By: bpresent

bpresent — Mon, 02 Feb 2009 05:58:48 +0000

admin,
thanks for getting back to me. so far i haven’t had any luck with that method. anything else you can think of?
thanks a lot.
- Ben

By: admin

admin — Thu, 29 Jan 2009 12:55:59 +0000

attn. Ben and Amita: i am sorry answering that late
for your problem i unfortunately cannot help you with 100% working solution. The way that should works is downloading of spyware doctor from removal-tool.com at another uninfected machine and installation it at the infected one (copy it to through flash card). Alternatively, especially if you are running IE, please download other browser e.g. Firefox mozila (free browser available through Google) and try our links in there.

By: bpresent

bpresent — Wed, 28 Jan 2009 19:54:03 +0000

Amita,
I am having the same problem. This thing is driving me nuts. Have you figured anything else out to get rid of this thing?
- Ben

By: Amita

Amita — Tue, 27 Jan 2009 18:23:13 +0000

Hello!

My name is Amita I’m from chicago IL. Usa.
I need you to help me with this matter please.

My pc got Win32.Zafi.B last week and I tried to download your sofware many times, to remove it, but I think this virus doesn’t let me see some webpages all I can see is “the webpage cannot be found”. I’d like to remove it by myself, If it is possible. Otherwise I have to call for a technician.

Thank you so much!