Title: Win32 Zafi b

Type: Trojans

Remove Win32 Zafi b. Removal instructions

Severity scale:

(60 / 100)

Win32.Zafi.b is a name of a threat that you may see in a faked security alert message. This message mostly appears with Perfect Defender 2009, that is rogue application, infection. Why infection? Cause this program by showing fake security alerts tries to force users into purchasing of nonworking program. Win32.Zafi.b worm spreads via infected video codec's and file sharing networks. The bad side of this “goodie” is the ability to disable antivirus and other security products on user’s computer increasing possibility of infection. To avoid problems that Win32.Zafi.b can bring we highly recommend you to use reliable anti-spyware.

Win32 Zafi b properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic Win32 Zafi b removal:

remover for Win32 Zafi b

SpyHunter is recommended remover to uninstall Win32 Zafi b. You should confirm using free trial that it detects current version of parasite.

Note: Manual assistance required means that one or all of removers were unable to remove parasite without some manual intervention, please read manul removal instructions below.

If you failed to remove Win32 Zafi b using SpyHunter please report this to us.

We might be affiliated with any product we recommend on the site. Full disclosure in our Agreement of Use.

STOPzilla

download | review

We are testing STOPzilla's efficiency at removing Win32 Zafi b (2009-04-06 10:42:03)

Malwarebytes Anti Malware

download | review

We are testing Malwarebytes Anti Malware's efficiency at removing Win32 Zafi b (2009-04-06 10:42:03)

Spyware Doctor

download | review | tutorial

We are testing Spyware Doctor's efficiency at removing Win32 Zafi b (2009-04-06 10:42:03)

XoftSpySE Anti Spyware

download | review

Information added: 2009-01-12 01:03:38
Information updated: 2009-04-06 08:04:48

Additional resources related to Win32 Zafi b:

Attention: If you know or you have a website or page about Win32 Zafi b removal, feel free to add a link to this list: add url

more resources

<Guest>

removal tool doesn't work

Reply »

2009 01 15

<Guest>

removal tool doesn't work!!

Reply »

2009 01 16

<Guest>

Not sure who to trust with these win32.zafi.b alerts popping up

Reply »

2009 01 16

<Guest>

did'nt work for me

Reply »

2009 01 17

<Guest>

Spyware Doctor does not detect or remove the zafi. b infection. I ran Pc tools Spyware Doctor and it told me my system is clean despite the fake warnings and hijacking of my browser to the Defense 9000 web site.

Reply »

2009 01 17

<Guest>

this is really strange because it says that this is caused by video. Now we thought it was by email or pictures in emails. I guess we were wrong. This helped a lot. Thanks!

Reply »

2009 01 20

<Guest>

yeh i've got hit by this virus and cant seem to find a solution for getting rid of it. its messin my comp up big time. The automatic removal dowload dont do anything. i downloaded the spyware doctor thing but its not helped at all.

still have the problem.

Reply »

2009 01 20

<Guest>

Malwarebytes Anti Malware found torsi2225487.exe and lptspcp.dll hiding in the C:docopenapplication datagoogle. - removed them on reboot and no more fake alerts. Spydoctor did nothing to remove them. Thanks for the info

Reply »

2009 01 31

<Guest>

First indicator of the Win32.Zafi.B was computer re-start.
No identiable Zafi.B files found in registry. System restore worked,
going back three days. Lost some data plus a program install, but
the Win32.zafi.B popup is gone.

Reply »

2009 02 01

<Guest>

program was hiding in C:Documents and SettingsUSERPROFILENAMEApplication DataGoogle as a .dll and a .exe with different but similarly generated names as mentioned 2 posts down. removal of these stopped the pop up as well as allowed me access to msconfig without autoshutdown.

Reply »

2009 02 02

<Guest>

adaware didn't work - malwarebyte - anti-malware did after 2 tries and update.

Reply »

2009 02 02

<Guest>

found infected files from posts 2 and 4, but I can't delete these files and Malwarebytes and AVG scans don't find them infected.
Are these really viruses and how do I remove them?
Please help!

Reply »

2009 02 02

Chromesphere.com

Yep, same here. restarts, and that 'drwwin.exe' message. 2 files in the app data / google directory. Booted up into safe mode (they are locked in normal mode) and deleted them both. Smooth sailing so far. Good luck.

Reply »

2009 02 02

<Guest>

Norton did not find them, nor spy doctor, but malwarebytes found and cleaned them immediately.

I notice that my errant files had different file names to those in the other posts! maybe a bit more sneaky than we thought

Reply »

2009 02 03

<Guest>

program was hiding in C:Documents and SettingsUSERPROFILENAMEApplication DataGoogle as a .dll and a .exe with different but similarly generated names as mentioned 2 posts down.

Use the unlocker.exe to unlock all bind apps and delete those two files solve the issue

Reply »

2009 02 04

Joseph Braun

My company has a laptop user that is running into this problem, however I have not found the files that were mentioned in several of the posts. I checked the equivalent location (as we use Vista, not XP), but there was no "Google" folder there.

Reply »

2009 02 04

<Guest>

Its also hiding in the windows prefetch directory so even if you delete it, it will restore its self on reboot. You have to clean it from both locations.

Reply »

2009 02 04

<Guest>

I tried a Microtrend housecall, avg, and McFee Stinger. None worked. I tried for free Superantispyware Free Edition. It did the trick. It found the fake alerts and removed them. I had not yet downloaded any thing from the alerts. I rebooted and the alerts are gone.

Reply »

2009 02 07

<Guest>

It is true that SuperAntispyware does work. it actaully did work for mine.

Reply »

2009 02 08

<Guest>

ermoval tool not working?

Reply »

2009 02 09

<Guest>

It started on my machine (Vista) couple of days back. I did not find any of the .exe previously mentioned but did find a mssclock.exe in the usersappdataroaminggoogle folder.

Is it the same ??

Reply »

2009 02 09

<Guest>

much appreciated advice, I figured it was a spoof of sorts when the 'Perfect Defender' page kept showing up.
Thankyou again.

Reply »

2009 02 10

<Guest>

It seems like the SuperAntiSpyware has the best reviews on the Win 32.Zafi.B virus, i plan to install it and use it once I get home. I will let you all know how it goes, but after a few hours of researching, that has been my final answer.

Reply »

2009 02 12

<Guest>

I try CCleaner. delete index.dat files. After internet explorer works better.

Reply »

2009 02 15

Jake

I thought it was strange Mozilla Firefox was linking to a website supposedly partnered with Microsoft

Reply »

2009 04 05

PeeDee

I downloaded this and got the update but it can not find it when I scan for it, I have found where the virus was hidden and I got rid of the pop up, but it wouldn't let me delete the DLL file, and my laptop will not connect to the net anymore. anyone have a solution?

Reply »

2009 04 06

Post Comment:

Attention: Use this form only if you have additional information about Win32 Zafi b parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.

Latest spyware news:

Subscribe to news

Similar parasites:

Compare spyware removers
Compare free products

HijackThis Log Analyzer Beta 2

Spreading the knowledge:

It is very hard to fight Computer parasites alone in internet space. If you have a website we would be more than happy if you would help us to spread the knowledge about latest threats. You can help your visitors to manage their Computer system manually without aditional expences. Knowledge is the power, we just need to spread it.