zafi
Clean Zafi 1.2
Clean Zafi is a free tool to detect and remove all variant of the Zafi virus (b, c and d) more>>
Clean Zafi detects and removes all variant of the Zafi virus.
CleanZafi 1.2
A free tool to detect and remove all variant of the Zafi virus more>>
Zafi is a mass-mailing worm that contains an infected attachment. Zafi.d sends itself in christmas wish messages attached as .pif, .cmd, .bat, .com or .zip file.
CleanZafi is an antivirus tool which can detect and remove all variants of the Zafi Virus. It is specially made for the Zafi Virus.
The worm may also attempt to lower security settings, terminate processes, and open a back door on the compromised computer.
Zafi.D Remover 3.5.1.11
This tool will help you easily clean the Zafi virus from your PC more>> This tool will help you easily clean the Zafi virus from your PC
Zafi.D is a worm with backdoor characteristics, as it opens the port 8181 and waits for a file to be transferred through it. Zafi.D executes this file, which is usually other malware.
Additionally, Zafi.D impedes access to applications that contain the text strings reged, msconfig or task.
Zafi.D spreads via e-mail messages that pass themselves off as Christmas greetings. It also spreads through peer-to-peer (P2P) file sharing programs.
The Zafi.D Remover utility will allow you to easily get rid of the virus infection from your computer.
Remover for I-Worm.Zafi.B,D 2.0
A tool which removes I-Worm.Zafi.B,D more>> A tool which removes I-Worm.Zafi.B,D
This virus removal tool was designed to help users disinfect their computers when infected with I-Worm.Zafi.B,D.
The worm sends messages in different languages. For this purpose, it checks the domain extension of the email address.
To activate the worm when Windows starts, it enters the created .exe file in the Registry. For this purpose, it creates a value with the name ?_Hazafibb" in the following Registry key:
HKLMSoftwareMicrosoftWindowsCurrentVersionRun
To prevent, that more than one instance of the worm is running, it creates a mutex with the name ?_Hazafibb".
Creates the Registry key:
HKLMSoftwareMicrosoft_Hazafibb
Terminates processes containing one of the following strings:
msconfig
regedit
task
Tries to overwrite .exe files of known security programs, with its own code.
Performs a DoS attack against the following domains:
www.2f.hu
www.parlament.hu
www.virusbuster.hu
www.virushirado.hu
Tries to distribute using file sharing networks. For this purpose, the worm copies itself to all folders, containing the strings ?share" or ?upload" in their name. For this purpose, the worm uses the following file names:
Total Commander 7.0 full_install.exe
winamp 7.0 full_install.exe
To distribute by email, the worm gathers email addresses, from files with the following file extensions:
.adb
.asp
.dbx
.eml
.htm
.mbx
.php
.pmr
.sht
.tbb
.txt
.wab
Dont gathers addresses, containing one of the following strings:
admi
cafee
google
help
hotm
info
kasper
micro
msn
panda
sopho
suppor
syma
trend
use
vir
webm
win
yaho
Sends multilingual messages to the gathered addresses.
I-Worm.Zafi.b removal tool 12.0.0.0
I-Worm.Zafi.b removal tool- removal tool for I-Worm.Zafi.b and I-Worm.Bagle.at,au more>>
If your computer has been infected by I-Worm.Zafi.b virus, you can download a free removal utility here.
Command line:
/s[n] - to force scanning of hard drives. Program will scan hard
drives for infection in any case.
n - include scanning of mapped network drives.
/y - end program without pressing any key.
/i - show command line info.
/nr - do not reboot system automatically in any case.
/Rpt[ao][= ] - create report file
a - add report file
o - report only (do not cure/delete infected files)
Return codes:
0 - nothing to clean
1 - virus was deleted and system restored
2 - to finalize removal of virus you should reboot system
3 - to finalize removal of virus you should reboot system and start
program the second time
4 - program error.
McAfee AVERT Stinger 10.0.1.602
Free stand-alone utility used to detect and remove specific viruses more>> Free stand-alone utility used to detect and remove specific viruses
Stinger is a stand-alone utility used to detect and remove specific viruses.
McAfee AVERT Stinger is not a substitute for the full anti-virus protection, but rather a tool that assists administrators and users when dealing with an infected system.
Stinger utilizes next generation scan engine technology, including process scanning, digitally signed DAT files, and scan performance optimizations.
This version of Stinger includes detection for all known variants :
? BackDoor-ALI
? BackDoor-AQJ
? BackDoor-AQJ.b
? BackDoor-CEB
? BackDoor-CEB!bat
? BackDoor-CEB!hosts
? BackDoor-CEB.b
? BackDoor-CEB.c
? BackDoor-CEB.d
? BackDoor-CEB.dll
? BackDoor-CEB.dr
? BackDoor-CEB.e
? BackDoor-CEB.f
? BackDoor-CEB.sys
? BackDoor-CFB
? BackDoor-JZ
? BackDoor-JZ.dam
? BackDoor-JZ.dr
? BackDoor-JZ.gen
? BackDoor-JZ.gen.b
? Bat/Mumu.worm
? Downloader-DN.a
? Downloader-DN.b
? Exploit-DcomRpc
? Exploit-DcomRpc.b
? Exploit-DcomRpc.dll
? Exploit-Lsass
? Exploit-Lsass.dll
? Exploit-MS04-011
? Exploit-MS04-011.gen
? HideWindow
? HideWindow.dll
? IPCScan
? IRC/Flood.ap
? IRC/Flood.ap.bat
? IRC/Flood.ap.dr
? IRC/Flood.bi
? IRC/Flood.bi.dr
? IRC/Flood.cd
? NTServiceLoader
? ProcKill
? PWS-Narod
? PWS-Narod.dll
? PWS-Narod.gen
? PWS-Sincom
? PWS-Sincom.dll
? PWS-Sincom.dr
? W32/Anig.worm
? W32/Anig.worm.dll
? W32/Bagle
? W32/Bagle!eml.gen
? W32/Bagle!pwdzip
? W32/Bagle.ad!src
? W32/Bagle.dldr
? W32/Bagle.dll.dr
? W32/Bagle.eml
? W32/Bagle.fb!pwdzip
? W32/Bagle.fc!pwdzip
? W32/Bagle.fd!pwdzip
? W32/Bagle.fe!pwdzip
? W32/Bagle.fm.dldr
? W32/Bagle.gen
? W32/Bagle@MM!cpl
? W32/Blaster.worm
? W32/Blaster.worm.k
? W32/Bropia.worm
? W32/Bugbear
? W32/Bugbear.a.dam
? W32/Bugbear.b!data
? W32/Bugbear.b.dam
? W32/Bugbear.gen@MM
? W32/Bugbear.h@MM
? W32/Bugbear@MM
? W32/Deborm.worm.ah
? W32/Deborm.worm.gen
? W32/Doomjuice.worm
? W32/Dumaru
? W32/Dumaru.ad@MM
? W32/Dumaru.al.dll
? W32/Dumaru.dll
? W32/Dumaru.eml
? W32/Dumaru.gen
? W32/Dumaru.gen@MM
? W32/Dumaru.w.gen
? W32/Elkern.cav
? W32/Elkern.cav.c
? W32/Elkern.cav.c.dam
? W32/Fizzer
? W32/Fizzer.dll
? W32/FunLove
? W32/FunLove.apd
? W32/Gaobot.worm
? W32/Harwig.worm
? W32/IRCbot
? W32/IRCbot.worm
? W32/IRCbot.worm.dll
? W32/Klez
? W32/Klez.dam
? W32/Klez.eml
? W32/Klez.gen.b@MM
? W32/Klez.rar
? W32/Korgo.worm
? W32/Lirva
? W32/Lirva.c.htm
? W32/Lirva.eml
? W32/Lirva.gen@MM
? W32/Lirva.htm
? W32/Lirva.txt
? W32/Lovgate
? W32/Mimail
? W32/Mimail.c@MM
? W32/Mimail.c@MM
? W32/Mimail.i!data
? W32/Mimail.q@MM
? W32/MoFei.worm
? W32/MoFei.worm.dr
? W32/Mumu.b.worm
? W32/Mydoom
? W32/Mydoom!bat
? W32/Mydoom!ftp
? W32/Mydoom.b!hosts
? W32/Mydoom.dam
? W32/Mydoom.t.dll
? W32/Mytob
? W32/Mytob.gen@MM
? W32/Mytob.worm
? W32/MyWife
? W32/MyWife.dll
? W32/MyWife@MM
? W32/Nachi!tftpd
? W32/Nachi.worm
? W32/Netsky
? W32/Netsky.af@MM
? W32/Nimda
? W32/Nimda.dam
? W32/Nimda.eml
? W32/Nimda.gen@MM
? W32/Nimda.htm
? W32/Pate
? W32/Pate!dam
? W32/Pate.dam
? W32/Pate.dr
? W32/Polip
? W32/Polip!mem
? W32/Polybot
? W32/Polybot.bat
? W32/Sasser.worm
? W32/Sasser.worm!ftp
? W32/Sdbot
? W32/Sdbot!irc
? W32/Sdbot.bat
? W32/Sdbot.cli
? W32/Sdbot.dll
? W32/Sdbot.dr
? W32/Sdbot.worm
? W32/Sdbot.worm!ftp
? W32/Sdbot.worm.bat.b
? W32/Sdbot.worm.dr
? W32/Sdbot.worm.gen
? W32/Sdbot.worm.gen.a
? W32/Sdbot.worm.gen.b
? W32/Sdbot.worm.gen.c
? W32/Sdbot.worm.gen.d
? W32/Sdbot.worm.gen.e
? W32/Sdbot.worm.gen.q
? W32/Sober
? W32/Sober!data
? W32/Sober.dam
? W32/Sober.eml
? W32/Sober.f.dam
? W32/Sober.g.dam
? W32/Sober.q!spam
? W32/Sober.r.dr
? W32/Sober.r@MM
? W32/Sobig
? W32/Sobig.dam
? W32/Sobig.eml
? W32/Sobig.f.dam
? W32/Sobig.gen@MM
? W32/Spybot.worm
? W32/SQLSlammer.worm
? W32/Swen
? W32/Swen@MM
? W32/Yaha.eml
? W32/Yaha.gen@MM
? W32/Yaha.y@MM
? W32/Yaha@MM
? W32/Zafi
? W32/Zafi.b.dam
? W32/Zindos.worm
? W32/Zotob.worm
? W32/Zotob.worm!hosts
Note: Windows ME and XP utilize a restore utility that backs up selected files automatically to the C:_Restore folder.
The filename has been changed from "stinger.exe" to "s-t-i-n-g-e-r.exe" to circumvent anti-stinger tactics used by Sober.p.
This means that an infected file could be stored there as a backup file, and VirusScan will be unable to delete these files. You must disable the System Restore Utility to remove the infected files from the C:_Restore folder.
W32/Swen@MM W32/Yaha@MM W32/Zafi. W32/Zindos.worm@MM W32/Sober W32/Sobig W32/SQLSlammer.worm W32/Swen@MM W32/Yaha@MM W32/Zafi W32/Zindos.worm Note: Windows ME and XP utilize a restore utility that backs up selected files automatically
avast! Virus Cleaner 1.0.207
A free tool that removes the most common viruses & worms from your computer. more>> avast! Virus Cleaner is a free tool that will completely remove selected viruses from PC. It is able to stop viruses that are active in memory, it will disinfect your files, remove virus registry & startup items, and virus working files. Currently, it can handle these virus families: Badtrans, Beagle, Blaster, BugBear, Ganda, Klez, MiMail, MyDoom, Nachi, NetSky, Nimda, Opas, Parite, Sasser,Scold, Sircam, Sober, Sobig, Swen, Yaha,Zafi incl. var.<<less
VCleaner 0.998
Vcleaner removal utility will detect and remove most known viruses more>>
- BackDoor.Agent.A-Z, AA-BG
- Downloader.Agent.AS
- I-Worm/Atak.A-I
- I-Worm/Bagle.A-Z, AA-BA
- I-Worm/Bugbear.D
- I-Worm/Netsky.A-Z, AA-AD
- I-Worm/Sasser.A-F
- I-Worm/Zafi.A-D
- PSW.Bispy.A-E
Note: Some viruses can stop the action during the removal process. In this case rename the vcleaner.exe to some different exe file (e.g. something.exe). Restart your computer in Safe mode (recommended) and run the remover on the infected computer.
Kaspersky Free Cleaner 12.0.0.20
Clean infection by: I-Worm.Bagle.at,au, Virus.Win32.Implinker.a, Not-a-virus.AdWare.Visiter. more>> Clean infection by: I-Worm.Bagle.at,au, Virus.Win32.Implinker.a, Not-a-virus.AdWare.Visiter.
Kaspersky Free Cleaner is a software tool that will allow you to clean infection by: I-Worm.Zafi.b, I-Worm.Bagle.at,au, Virus.Win32.Implinker.a, Not-a-virus.AdWare.Visiter.
If program finds any processes in memory, infected by these viruses,
it will try to unhook virus hooks and patch needed processes to stop reinfection or stop them and delete/cure their files on hard drive and delete links to their files from system registry and other startup places.
If program finds any infected processes in memory it will start scanning of your hard drives. It will check only infection by these viruses. If you specify /s key in command line, the program will scan your hard drives (and all mapped network drives if you specify /sn) in all cases.
In case program can not delete or rename any files (it may be used at the moment) it adds these files to the queue to delete or rename during next bootup process and offer user to reboot system.
Command line:
/s[n] - to force scanning of hard drives. Program will scan hard drives for infection in any case.
n - include scanning of mapped network drives.
/y - end program without pressing any key.
/i - show command line info.
/nr - do not reboot system automatically in any case.
/Rpt[ao][=] - create report file
a - add report file
o - report only (do not cure/delete infected files)
Return codes:
0 - nothing to clean
1 - virus was deleted and system restored
2 - to finalize removal of virus you should reboot system
3 - to finalize removal of virus you should reboot system and start program the second time
4 - program error.
Enhancements:
- added Email-Worm.Win32.Warezov virus
Swen I-Worm.Tanatos.a,b I-Worm.Torvil.d I-Worm.Winevar I-Worm.Zafi.b Trojan.Win32.Krotten Trojan.Win32.SilentLog.a-b Trojan.Win32.StartPage.fw TrojanDownloader.Win32.Agentsoftware tool that will allow you to clean infection by: I-Worm.Zafi.b, I-Worm.Bagle.at,au, Virus.Win32.Implinker.a, Not-a-virus.AdWare.Visiter. If program finds any processes in memoryF-Force Malware Disinfection 1.00.0012
F-Force is a free malware disinfection utility created by F-Secure more>>
Agobot (Backdoor.Win32.Agobot)
Aimbot (Backdoor.Win32.Aimbot)
Bagle (Email-Worm.Win32.Bagle, except .N, .O, .P, .Q, .R variants)
Bozori (Net-Worm.Win32.Bozori)
Codbot (Backdoor.Win32.Codbot)
Dumaru (Email-Worm.Win32.Dumaru)
Fanbot (Backdoor.Win32.Fanbot)
Forbot (Backdoor.Win32.Forbot)
IRCBot (Backdoor.Win32.IRCBot)
Mitglieder (Trojan-Proxy.Win32.Mitglieder or Trojan-Spy.Win32.Mitglieder)
Mydoom (Email-Worm.Win32.Mydoom)
Mytob (Net-Worm.Win32.Mytob)
Netsky (Email-Worm.Win32.NetSky)
Padobot (Net-Worm.Win32.Padobot)
Poebot (Backdoor.Win32.Poebot)
Rbot (Backdoor.Win32.Rbot)
SDBot (Backdoor.Win32.SdBot)
Spybot (P2P-Worm.Win32.SpyBot)
Wootbot (Backdoor.Win32.Wootbot)
Zafi (Email-Worm.Win32.Zafi)
In addition the F-Force utility detects EICAR test file.
The F-Force utility might be able to disinfect computers that are infected
with new variants of these backdoors and worms, however disinfection will
only work if these variants are detected generically by AVP engine.
The F-Force utility disinfects Windows HOSTS file by removing entries that
were added by malware. In addition the utility automatically restores the
default EXE file startup string in case it was modified by malware.
The F-Force utility creates a log file named F-FORCE.LOG in the root
Windows directory (usually C:WINDOWS). The log file is appended every
time the F-Force utility is run.
HOW TO MAKE IT WORK:
1. Unpack the F-Force utility from the provided ZIP archive either with
WinZip or PkUnzip utilities. A trial version of WinZip archiver can be
downloaded from the following website:
http://www.winzip.com/ddchomea.htm
2. Download the archive called LATEST.ZIP from F-Secure web or ftp sites.
This archive contains the latest anti-virus database files. It can be
downloaded from these URLs:
http://www.f-secure.com/download-purchase/latest.zip
ftp://ftp.f-secure.com/anti-virus/updates/latest/latest.zip
3. Place the downloaded LATEST.ZIP archive in the same folder where the
F-Force utility is located.
4. Run the unpacked F-Force.exe file from a hard disk to eliminate malware
infection. You can run the utility by either double-clicking on its file
from Windows Explorer or you can start it from a command prompt (to open a
command prompt click Start button, select Run menu and type CMD.EXE
(if you have Windows NT, 2000 or XP) or type COMMAND.COM (if you have
Windows 98 or ME). Then press Enter to run the command interpreter. In
the opened command prompt window you have to type CD command followed by
a folder name where the F-Force utility is located, for example:
CD C:TEMP
Press Enter to run that command. To run the F-Force utility from that
folder type F-FORCE and press Enter.
First the F-Force utility will kill all detected malware processes in
memory. Then the utility will remove all startup Registry key values
created by the malware and finally it will scan all available hard disks
and delete all infected files. If needed, the utility disinfects Windows
HOSTS file and restores the default value of EXE file startup key in the
Registry.
5. Reboot the system. After restart your system should be clean from the
above mentioned malware.
If you have F-Secure Anti-Virus installed, the utility will temporarily
disable the on-access scanner (OAS) to be able to disinfect your system.
After the utility completes disinfection it enables the on-access scanner.
You can get a trial version of F-Secure Anti-Virus and the latest updates
for it from our website:
http://www.f-secure.com/download-purchase/list.shtml
http://www.f-secure.com/download-purchase/updates.shtml
Multi Virus Cleaner 2007 7.7.0
Multi Virus Cleaner is a small freeware utility to remove from you computer the most important viruses more>>
Multi Virus Cleaner is able to detect common dialers and trojans installed on you PC.
Multi Virus Cleaner is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when cleaning infected systems.
Multi Virus Cleaner is regularly updated and can detect over 5,500 common viruses, worms, trojans and dialers (including all variants of the Sober, MyDoom and Bagle viruses).
Multi Virus Cleaner boasts a fast, user-friendly scanner that requires minimal processing power and is an excellent choice for repairing a compromised system.
System requirements:
- Processor 400 Mhz
- 128 MB RAM
- SVGA 800x600 display
- 256 colors
important viruses, worms and other malware such as: MyDoom, Bagle, Sasser, Zafi, Netsky, Klez, Sobig, Welchia and Blaster. Multi Virus Cleaner is able to detect common dialers and trojans installedMulti Virus Cleaner 2008 8.6.1
Multi Virus Cleaner is a free, stand-alone utility used to detect and remove major viruses. more>>
Multi Virus Cleaner 2008 8.6.1 is designed as a small freeware utility to remove from you computer the most important viruses, worms and other malware such as: MyDoom, Bagle, Sasser, Zafi, Netsky, Klez, Sobig, Welchia and Blaster.
Multi Virus Cleaner is able to detect common dialers and trojans installed on you PC. Multi Virus Cleaner is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when cleaning infected systems.
Major Features:
- Multi Virus Cleaner is regularly updated and can detect over 5,500 common viruses, worms, trojans and dialers (including all variants of the Sober, MyDoom and Bagle viruses).
- Multi Virus Cleaner boasts a fast, user-friendly scanner that requires minimal processing power and is an excellent choice for repairing a compromised system.
- Multi Virus Cleaner is a free, stand-alone utility used to detect and remove major viruses. It is not a substitute for full anti-virus protection, but rather a tool to assist administrators and users when cleaning infected systems.
- Multi Virus Cleaner is regularly updated and can detect over 6,000 common viruses, worms, trojans and dialers (including all variants of the Sober, MyDoom and Bagle viruses).
- The program boasts a fast, user-friendly scanner that requires minimal processing power and is an excellent choice for repairing a compromised system.
Enhancements:
- 7th-generation real-time behavioral analysis engine
- which quickly detects harmful programs, like viruses, worms, and spyware
- New threat analysis engine
- VirusKeeper 2007 comes with a new analysis engine that is faster and more efficient.
- It provides new detection methods to help catch new threats.
- Improved spyware detection
- VirusKeeper detects spyware programs.
- VirusKeeper also protects critical system resources.
- Real-time process analysis
- VirusKeeper 2007 identifies all programs running in memory.
- It detects maliciousprograms and neutralizes them.
- ProcessWatch II, a tool for detecting the most virulent viruses
- VirusKeeper 2007 now includes the ProcessWatch II tool that detects all programs loaded in memory. The user can view the properties of any running process (file name, location, size, dlls used) and can stop it.
- The new ProcessWatch II show all components added to the browser (tool bar, etc ...) and identifies all programs started on Windows start-up.
- Internet Expl...
Requirements:
- Processor 400 Mhz
- 128 MB RAM
- SVGA 800x600 display
- 256 colors
remover.exe 1.011.0157
remover.exe detects and removes many worms, trojans and backdoors: Mydoom, Beagle, Netsky, Sasser, Blaster Zafi, Mabutu more>>
Caution: Administrative rights required.
1. Click download link next to virus name.
2. Save the file locally on your computer.
3. Close all Windows applications.
4. Turn AVK Monitor off, if enabled.
This download is marked as adware because it displays advertisement banners or other type of commercials while running. G DATA Software Sp. z o.o. - many worms, trojans and backdoors: Mydoom, Beagle, Netsky, Sasser, Blaster Zafi, Mabutu. remover.exe. Removal tool will detect and remove many, trojans and backdoors: Mydoom, Beagle, Netsky, Sasser, Blaster Zafi, Mabutu, Startpage and many others more information: http://wirusy.antivirenkit.pl/ remover.exe 1.0.0.8 - G DATA Software
, trojans and backdoors: Mytob, Mydoom, Beagle, Netsky, Sasser, Blaster Zafi, Startpage Switches /G - Dont check the AVK Monitor status (optional) /N - Scan mapped network drives (optional) /I- Page: 1 of 1
- 1
