Win32.Zafi.B

Hello.
I made a mistake and it set a value instead of deleting it.

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "wclock"=-
  
  

  
  
• Save this as fix.reg, save it to your desktop.
  
• Double click fix.reg to run it.
  
• Select yes to the registry merge prompt.
  

What problems remain?

At first glance, both browsers (FF and Opera) now appear to be functioning correctly. Google searches are not being redirected, and I can get onto the Eset website without problem (was being redirected before).

I am removing NOD32 and reinstalling, for the duration of the infection I had removed my existing (paid) version and installed the latest beta test, however the virus wouldn't allow it to update to the latest virus library, and there may be an issue with the password I have been provided with. I am reinstalling my existing version to see if it will allow me to update the virus libraries.

Other than that, everything seems fine. Would it be a good idea to change my login password, and my email passwords? Presumably the access passwords to my router will be unaffected but should I change them anyway? Forums I'm not concerned with, and I do not use internet banking although I do use Paypal and Ebay - I'll change those.

Change them if you feel you want to, but the virus hasn't stolen any passwords.

NOD32 reinstalled (downloaded direct from ftp) perfectly and has updated itself without issue.

I will keep a close eye on the computer for now, but I'd like to express my sincere gratitude for your help resolving this. I know I'm just words on a screen, but believe me when I say I am one very very grateful computer owner, and that if there is anything I can do to return your hard work, please just let me know.

Thank you very much.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

Thankyou for the excellent advice I have created a new restore point. I will download some of the spyware tools you recommended, other than that I already follow the rest of the advice. Everything is updated automatically, on a daily basis.

I am utterly clueless as to how this infection occurred, I never open unknown attachments so I'll have a read of that guide.

Once again, thank you very much for your help. By the way, I don't suppose you have a link that explains what this virus does?

Read about it here:
http://www.f-secure.com/v-descs/zafi_b.shtml

ahh, email gathering only. That's alright, I tend to think most of the people I email myself have limited or no virus protection anyway. They can have some back

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.