Remove Win32 Zafi b. Description and removal instructions

 
Title: Win32 Zafi b

Type: Trojans
Severity scale:Win32 Zafi b severity is 60  (60 / 100)
 
Win32.Zafi.b is a name of a threat that you may see in a faked security alert message. This message mostly appears with Perfect Defender 2009, that is rogue application, infection. Why infection? Cause this program by showing fake security alerts tries to force users into purchasing of nonworking program. Win32.Zafi.b worm spreads via infected video codec's and file sharing networks. The bad side of this “goodie” is the ability to disable antivirus and other security products on user’s computer increasing possibility of infection. To avoid problems that Win32.Zafi.b can bring we highly recommend you to use reliable anti-spyware.


Win32 Zafi b properties:
• Changes browser settings
• Shows commercial adverts
• Connects itself to the internet
• Hides from the user
• Stays resident in background

Automatic Win32 Zafi b removal:

remover for Win32 Zafi b

Other programs to remove Win32 Zafi b:

• Malwarebytes Anti Malware - Review - Download
• Malwarebytes Anti Malware - Review - Download
• Windows Defender - Review - Download

Information added: 12/01/09
Information updated: 06/04/09

Additional resources related to Win32 Zafi b:

Attention: If you know or you have a website or page about Win32 Zafi b removal, feel free to add a link to this list: add url




more resources

Post Comment:

Attention: Use this form only if you have additional information about Win32 Zafi b parasite, its removal instructions, additional resources or behavior. By clicking "post comment" button you agree not to post any copyrighted, unlawful, harmful, threatening, abusive, harassing, defamatory, vulgar, obscene, profane, hateful, racially, ethnically or otherwise objectionable material of any kind.



Enter security code:


Comments from visitors:


1. by PeeDee. 2009-04-06 08:04:48
I downloaded this and got the update but it can not find it when I scan for it, I have found where the virus was hidden and I got rid of the pop up, but it wouldn't let me delete the DLL file, and my laptop will not connect to the net anymore. anyone have a solution?

2. by Jake. 2009-04-05 04:04:59
I thought it was strange Mozilla Firefox was linking to a website supposedly partnered with Microsoft

3. by . 2009-02-15 19:02:57
I try CCleaner. delete index.dat files. After internet explorer works better.

4. by . 2009-02-12 06:02:57
It seems like the SuperAntiSpyware has the best reviews on the Win 32.Zafi.B virus, i plan to install it and use it once I get home. I will let you all know how it goes, but after a few hours of researching, that has been my final answer.

5. by . 2009-02-10 18:02:07
much appreciated advice, I figured it was a spoof of sorts when the 'Perfect Defender' page kept showing up.
Thankyou again.

6. by . 2009-02-09 08:02:40
It started on my machine (Vista) couple of days back. I did not find any of the .exe previously mentioned but did find a mssclock.exe in the usersappdataroaminggoogle folder.

Is it the same ??

7. by . 2009-02-09 01:02:30
ermoval tool not working?

8. by . 2009-02-08 00:02:16
It is true that SuperAntispyware does work. it actaully did work for mine.

9. by . 2009-02-07 14:02:08
I tried a Microtrend housecall, avg, and McFee Stinger. None worked. I tried for free Superantispyware Free Edition. It did the trick. It found the fake alerts and removed them. I had not yet downloaded any thing from the alerts. I rebooted and the alerts are gone.

10. by . 2009-02-04 16:02:37
Its also hiding in the windows prefetch directory so even if you delete it, it will restore its self on reboot. You have to clean it from both locations.

11. by Joseph Braun. 2009-02-04 13:02:15
My company has a laptop user that is running into this problem, however I have not found the files that were mentioned in several of the posts. I checked the equivalent location (as we use Vista, not XP), but there was no "Google" folder there.

12. by . 2009-02-04 10:02:43
program was hiding in C:Documents and SettingsUSERPROFILENAMEApplication DataGoogle as a .dll and a .exe with different but similarly generated names as mentioned 2 posts down.

Use the unlocker.exe to unlock all bind apps and delete those two files solve the issue

13. by . 2009-02-03 07:02:58
Norton did not find them, nor spy doctor, but malwarebytes found and cleaned them immediately.

I notice that my errant files had different file names to those in the other posts! maybe a bit more sneaky than we thought

14. by Chromesphere.com. 2009-02-02 20:02:41
Yep, same here. restarts, and that 'drwwin.exe' message. 2 files in the app data / google directory. Booted up into safe mode (they are locked in normal mode) and deleted them both. Smooth sailing so far. Good luck.

15. by . 2009-02-02 20:02:00
found infected files from posts 2 and 4, but I can't delete these files and Malwarebytes and AVG scans don't find them infected.
Are these really viruses and how do I remove them?
Please help!

16. by . 2009-02-02 15:02:49
adaware didn't work - malwarebyte - anti-malware did after 2 tries and update.

17. by . 2009-02-02 14:02:00
program was hiding in C:Documents and SettingsUSERPROFILENAMEApplication DataGoogle as a .dll and a .exe with different but similarly generated names as mentioned 2 posts down. removal of these stopped the pop up as well as allowed me access to msconfig without autoshutdown.

18. by . 2009-02-01 15:02:04
First indicator of the Win32.Zafi.B was computer re-start.
No identiable Zafi.B files found in registry. System restore worked,
going back three days. Lost some data plus a program install, but
the Win32.zafi.B popup is gone.

19. by . 2009-01-31 01:01:53
Malwarebytes Anti Malware found torsi2225487.exe and lptspcp.dll hiding in the C:docopenapplication datagoogle. - removed them on reboot and no more fake alerts. Spydoctor did nothing to remove them. Thanks for the info

20. by . 2009-01-20 17:01:01
yeh i've got hit by this virus and cant seem to find a solution for getting rid of it. its messin my comp up big time. The automatic removal dowload dont do anything. i downloaded the spyware doctor thing but its not helped at all.

still have the problem.

See more comments about Win32 Zafi b >>>
Latest spyware news:
Similar parasites: