Spyware, viruses, & security : Win32.Zafi.B - I think Trojan fake - PLEASE HELP

(NT) Like above - It worked :) - THANKS

In reply to: Maybe you also have a look....... by Marianna Schmudlach 

One more thing

After successful removal, I checked all of my temp internet file directories and it was apparent that this prolific virus was busy. For me (show hidden files):

C:\documents and settings\{my name}\local settings\temp\temporary internet settings\

There were a plethora of randomly generated directories. I had noticed the day prior that any downloads would appear to download properly but at the end, the file would "dump" from one of these phantom folders. Naturally, I deleted all the files that I could, but many were "undeleteable". So I had to revert to the DOS CMD prompt days to remove these obviously malicious files that still were undetected by my thrice-virus-checked HD.

After all that, I did a folder-by-folder manual check for more filth.

Good luck all!

remember

remember to change any passwords you might have typed in on your email or anything else, because as I mentioned earlier, it looks like there was a keylogger involved and it had already sent out information from my system at that time.

Some additional details

In reply to: Maybe you also have a look....... by Marianna Schmudlach 

These steps seem to have worked for me, too -- many thanks!

One thing I noticed was that the .exe was set up in the registry to run on startup -- which meant that it was listed under Startup in the System Configuration utility (Start > Run > {type "msconfig [Enter]"}.

However, one of the effects of the fake-Trojan executable is that if you try to run msconfig, it reboots Windows immediately, before you can make any changes! I didn't check, but I'm guessing it might do the same if you try to run regedit.

-- That seems to be about as subtle as it gets, though. I found that, though I couldn't *delete* the .exe and .dll outright, I could rename them to something else without any problem -- e.g., change the extensions to ".bad" -- then reboot. Then Windows can't find them on the next startup, and you can delete them without any problem... saves a few steps, anyway.

Zafi.B Experiences

"I found that, though I couldn't *delete* the .exe and .dll outright, I could rename them to something else without any problem -- e.g., change the extensions to ".bad" -- then reboot. Then Windows can't find them on the next startup, and you can delete them without any problem... saves a few steps, anyway."

First, thanks for everyones' comments on this topic.

One of the problems I encountered was that that the trojan disabled the Task Manager. While running a Symantec system scan, I was able to bring up the process map on the task manager and noticed a strange file name "wfhuj470671.exe." According to Symantec, the Zafi.B infection starts by creating the *.exe and *.dll with a random name. Intution told me this was the offensive file, so I c/p'ed the file name in a search and found them in the aforementioned ->\Google directory. I closed the process tree and was about to delete it.

I then searched the registry and deleted all entries with that file name, and took similar registry action on the name of the *.exe and *.dlls of the alleged fake anti-spyware.

When I rebooted and reexamined the task manager, i saw no strange filenames. I'm running MBAM right now, but it's already parsed the registry amd Doc/Settings folders, so I'm hoping the things is finished (no new popup windows since doing all this.)

Reminds me of the CWS trojan.

This worked for me

In reply to: Maybe you also have a look....... by Marianna Schmudlach 

I had the exe and dll in the google folder. I renamed them to .bad, rebooted, and deleted them, and now the popups have stopped. I also went into regedit and got rid of two references to those file names.

Now I'm running Malwarebyte for the second time. The first time, it found a trojan disguised as svchost, which it couldn't delete without rebooting. So after rebooting, I'm running it again, just to be safe.

Thanks for all the help - this thread is great!

Simple solution for fake ZafiB

After I struggled with futile approaches (AVG, AdAware, etc.) for 9 hrs to get rid of this fake ZafiB, I tried some advice from an online friend that worked beautifully and took me only 10 minutes: a System Restore.

For Windows XP, go to Start >> Help and Support >> Performance and Maintenance >> Using System Restore to Undo Changes >> Run System Restore Wizard.

You'll get a calendar popup. Select any date before ZafiB first appeared and run the wizard. It will reset your system to the way it was for the date you selected, getting rid of anything that was downloaded since that date (ZafiB, software updates, etc.). It does not affect any of your saved documents, your applications, or your computer clock.

ZafiB was popping up every 10 minutes on my computer yesterday. I did a System Restore, setting my computer back to the day before yesterday, and ZafiB was gone. It's been 12 hours now and I haven't seen that popup since.