PE_ZAFI.B Virus Warning

[Keefe]

This memory-resident file infector propagates via email and peer-to-peer (P2P) applications. It drops copies of itself using random file names and with either of the following file extensions:

EXE
DLL
To propagate via email, it sends itself to addresses it finds in files that have particular extension names. It specifies a mail server by attaching certain strings to the given domain in a target email address. It also avoids sending email messages to addresses that specific strings.

To spread through P2P file-sharing applications, it drops copies of itself in folders that contain the following strings in their names:


share
upload
It attempts to infect .EXE files, which it finds in random folders, by overwriting them. It deletes the files and then drops copies of itself using the same file names of the deleted files.

It also opens a random link previously visited by an infected user.

This file infector is compressed using FSG and runs on Windows 95, 98, ME, NT, 2000 and XP.


Solution:



AUTOMATIC REMOVAL INSTRUCTIONS

To automatically remove this malware from your system, please use Trend Micro Damage Cleanup Services.

MANUAL REMOVAL INSTRUCTIONS

Identifying the Malware Program

To remove this malware, first identify the malware program.


Scan your system with your Trend Micro antivirus product.
NOTE all files detected as PE_ZAFI.B.
Trend Micro customers need to download the latest pattern file before scanning their system. Other users can use Housecall, Trend Micro’s free online virus scanner.

Terminating the Malware Program

This procedure terminates the running malware process. You will need the name(s) of the file(s) detected earlier.

Open Windows Task Manager.
» On Windows 95, 98, and ME, press
CTRL+ALT+DELETE
» On Windows NT, 2000, and XP, press
CTRL+SHIFT+ESC, then click the Processes tab.
In the list of running programs*, locate the malware file(s) detected earlier.
Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
Do the same for all detected malware files in the list of running processes.
To check if the malware process has been terminated, close Task Manager, and then open it again.
Close Task Manager.

--------------------------------------------------------------------------------
*NOTE: On systems running Windows 95, 98, and ME, Windows Task Manager may not show certain processes. You can use a third party process viewer such as Process Explorer to terminate the malware process. Otherwise, continue with the next procedure, noting additional instructions.
Removing Autostart Entries from the Registry

Removing autostart entries from the registry prevents the malware from executing at startup.

Open Registry Editor. Click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft>
Windows>CurrentVersion>Run
In the right panel, locate and delete the entry:
_Hazafibb = "%System%\<Dropped file name>"
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 95, 98 and ME, C:\WINNT\System32 on Windows NT and 2000, and C:\Windows\System32 on Windows XP.)
Close Registry Editor.

--------------------------------------------------------------------------------
NOTE: If you were not able to terminate the malware process as described in the previous procedure, restart your system.
Removing Other Malware Registry Entry


Open Registry Editor. To do this, click Start>Run, type REGEDIT, then press Enter.
In the left panel, double-click the following:
HKEY_LOCAL_MACHINE>Software>Microsoft
Still In the left panel, locate and delete the key:
_Hazafibb