Tutorial Removing Win32.Zafi.B, Succeed!
Sponsored Links
Win32.Zafi.B categorized as worm which can make your system damaged (Windows users). Win32.Zafi.B discovered on June 11, 2004, have a medium damage impact.
The virus spreading via email, with the following formats (for: .hu .sp .ru .dk .ro .se .se .no .fi .lt .pl .pt .de .nl .cz .fr .it) The From: field is spoofed. Here is the e-mail examples:
Subject: eIngyen SMS!
Body:
———————— hirdetés —————————–A sikeres 777sms.hu és az axelero.hu támogatásával újra
indul az ingyenes sms küldõ szolgáltatás! Jelenleg ugyan
korlátozott számban, napi 20 ingyen smst lehet felhasználni.
Küldj te is SMST! Nehány kattintás és a mellékelt regisztrációs
lap kitöltése után azonnal igénybevehetõ! Bõvebb információt
a www.777sms.hu oldalon találsz, de siess, mert az elsõ ezer
felhasználó között értékes nyereményeket sorsolunk ki!———————— axelero.hu —————————
Attachment: regiszt.php?3124freesms.index777.pif
How can we know that my computers infected? Here are several symptoms:
- Presence of the next files in %SYSTEM% folder: files with random names, the name is composed of 8 random letters, files with extension .dll and one with extension .exe most of the .dll files store e-mail addresses and are rather small in size (around 1 kbytes) a .dll file and the .exe file are copies of the virus, and have 12,800 bytes each
- Regedit, Task Manager, Task Monitor don’t work
- Presence in memory of a process called “link”
- When run, the virus opens Internet Explorer with a recently typed url
- Presence of the next registry keys or entries: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\”_Hazafibb”=”%SYSTEM%\%random%.exe”] where %random% is a name formed from 8 random characters [HKEY_LOCAL_MACHINE\Software\Microsoft\_Hazafibb] with entries b? c? d?, containing information about the infected computer and the exact names of the exe and dll files; where ? may be any digit or capital letter (eg: b1, bA, cA, etc) where %WINDOWS% points to Windows folder (or WinNT on Windows NT based systems) %SYSTEM% points to “System” folder on Windows 9x systems and “System32″ folder on WinNT systems.
How can I remove Win32.Zafi.B manually? Unfortunately, I can’t find how to remove Win32.Zafi.B in manual way. But you can use third party tools, such as Bitdefender to remove this worm automatically. Happy cleaning!
