I need computer help ASAP Virus

02-03-2009, 08:16 AM

My moms computer came up with a ZAFI.B virus alert this morning. Does anyone know a quick fix for this. The major problem is that all of our business info, and account numbers are on this computer.

Mugen910 · 02-03-2009, 08:18 AM

http://xphunt3r.blogspot.com/2008/12...s-removal.html

Volt · 02-03-2009, 09:33 AM

Sounds like Bao hooked you up, yell if you need any extra help.

poker · 02-03-2009, 09:36 AM

Instructions to get rid of Win32.Zafi.B
If you really want to remove the Win32.Zafi.B infection on your system manually then proceed as follows.
Turn off System Restore if you’re using Windows ME or XP. When you make changes to your system, Windows does a restoration checkpoint. If it does this while the system is infected, it may come back to re-infect later.
Restart the computer in Safe Mode. Since the Zafi.B worm creates running processes, and Windows doesn’t allow you to delete files connected with running processes, restarting is necessary. Using Safe mode prevents Windows from loading drivers and auto run entries so your system boots relatively clean. In addition, Zafi.B blocks the use of Regedit which is required below.
Run a full system scan with an updated antivirus scanner (or one of the online scanners mentioned above). If your scanner does not remove everything, follow the next few steps.
IMPORTANT: Your antivirus software should, during detection, produce a list of files associated with the W32/Zafi.B or W32/Erkez virus (depends on scanner). The files will be copies of the worm stored in the Windows system folder and shared folders mentioned above. You should set your antivirus to delete them. If not, delete them manually.
Make a backup of the registry before you edit. Delete the Run entries associated with Zafi.B from the registry. These will be:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run
and delete the key:
“_Hazafibb”=”%system%\<random file name>.exe”
Also delete the key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\_Hazafibb
Exit the registry editor.
Re-enable System Restore, reboot machine.
Re-scan to be sure all files are clean.

02-03-2009, 10:32 PM

Thanks guys with a couple of hours on line with the It guys it is all good to go.

02-03-2009, 08:16 AM	#1
Junior Guest Posts: n/a	I need computer help ASAP Virus My moms computer came up with a ZAFI.B virus alert this morning. Does anyone know a quick fix for this. The major problem is that all of our business info, and account numbers are on this computer.

02-03-2009, 08:18 AM	#2
Mugen910 I <3 Huy Join Date: Oct 2008 First Name: Location Location: First Name Posts: 8,387 Trading: (106)	Re: I need computer help ASAP Virus http://xphunt3r.blogspot.com/2008/12...s-removal.html __________________ I'm not antisocial, I just think people are stupid.

02-03-2009, 09:33 AM	#3
Volt I'm nuts for the place Join Date: Oct 2008 Posts: 2,799 Trading: (19)	Re: I need computer help ASAP Virus Sounds like Bao hooked you up, yell if you need any extra help. __________________ Curing the infection... One bullet at a time.

02-03-2009, 09:36 AM	#4
poker 1:11 Join Date: Oct 2008 First Name: Kelly Location: SoCal Posts: 5,280 Trading: (7)	Re: I need computer help ASAP Virus Instructions to get rid of Win32.Zafi.B If you really want to remove the Win32.Zafi.B infection on your system manually then proceed as follows. Turn off System Restore if you’re using Windows ME or XP. When you make changes to your system, Windows does a restoration checkpoint. If it does this while the system is infected, it may come back to re-infect later. Restart the computer in Safe Mode. Since the Zafi.B worm creates running processes, and Windows doesn’t allow you to delete files connected with running processes, restarting is necessary. Using Safe mode prevents Windows from loading drivers and auto run entries so your system boots relatively clean. In addition, Zafi.B blocks the use of Regedit which is required below. Run a full system scan with an updated antivirus scanner (or one of the online scanners mentioned above). If your scanner does not remove everything, follow the next few steps. IMPORTANT: Your antivirus software should, during detection, produce a list of files associated with the W32/Zafi.B or W32/Erkez virus (depends on scanner). The files will be copies of the worm stored in the Windows system folder and shared folders mentioned above. You should set your antivirus to delete them. If not, delete them manually. Make a backup of the registry before you edit. Delete the Run entries associated with Zafi.B from the registry. These will be: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run and delete the key: “_Hazafibb”=”%system%\<random file name>.exe” Also delete the key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\_Hazafibb Exit the registry editor. Re-enable System Restore, reboot machine. Re-scan to be sure all files are clean. __________________ Cigar Asylum: A cigar board birthed without agendas, without profiting, and without advertisements. Amor puro Character is what you do when no one is watching

02-03-2009, 10:32 PM	#5
Junior Guest Posts: n/a	Re: I need computer help ASAP Virus Thanks guys with a couple of hours on line with the It guys it is all good to go.