Worm.Win32.Zafi.B Alert!

This one is quite a nasty one. I've been battling it off of client's computers all weekend. One person's email was flooded with over 3000 bounced emails.

*edit*
Fixed link for above: http://www.emsisoft.com/en/malware/?Worm.Win32.Zafi.B

 

Thanks Daisy. I fixed that one too. Copied it right out of my email. Never checked the link. I got the same alert from McAffee a couple days ago. Thought I'd post this one though since A² is free.

 

Welcome!
From what I understand, this variant came out on Staurday. Sunday morning, my phone was ringing off the hook. I hope people are updating their virus definitions manually, and not relying on their automatic updates.

 

I meant to mention that Bitdefender has a removal tool as well.

 

Great! Now, you gonna handle the cleanups we get here? Or send me some notes?

 

Did I mention this one is a ROYAL pain in the ARSE?
I'm working on one as I write this. (sigh)

Effectively corrupts Norton's..and disables Zonealarm. Nice huh?

 

Yeah.......I think you mentioned that.

Symantec did that, IMO.


Notes Daizy, notes!

 

Yeppers....and it gives me another excuse to get it the heck off my client's computers.

Notes?
Disable system restore. Cross your fingers, toes and eyes, and run the removal tool. Sit back in awe of the damage it was doing. Charge customers an obscene enough amount of money that they'll remember in future to update their virus definations daily, and manually. (Yeah right! I never do.)

May need to contact your ISP to delete your email if you are getting bombed. (Yesterday's machine fix, had 3,000 messages waiting to be downloaded)

And ummmmm.....
Get to fixing and clearing out all other crud that you just KNOW they've loaded their systems up with.

Fun, fun, fun.

 

I haven't seen any other references to it disabling AV's and firewalls. Are they functional again after removal or do they require a reinstall?

 

Your wish is my command!

Here.

Symantec

 

Thanks Daizy.

Now wouldn't that make a nice signature line.