Wednesday, January 21, 2009

Beware the Win32/Zafi.B virus...

All,

In 7 years at my employer, I've never contracted a computer virus. Yesterday morning, a variant on the "Win32/Zafi.B" virus hit my laptop. It's supposed to be passed through e-mail, but I didn't open any suspicious e-mail, so I don't know how I got it. But, it managed to wipe every trace of every last file off my computer.

Part of the virus' nastiness is that it tricks users into thinking they're getting a message from Windows Firewall that the firewall has detected and blocked the virus. In fact, that IS the virus. So beware that pop-up, too.

In any case, it passes itself on in part by hijacking a user's e-mail address book. So, if you have any strange-looking e-mail from me, delete it immediately. And if your computer randomly receives a pop-up from "Windows Firewall" stating that you have the virus, shut it down, do NOT reboot, then go look up steps for removing the virus on another computer connected to the internet.

Fucking hackers. Damn you all.

2 comments:

MattL said...

Are you sure it was that one? All the references on the web I could find about it just say that it sends email (which would corroborate the windows firewall messages). I haven't seen anything about wiping the drive.

Brian said...

Update:

1. Matt, in response to your question, yeah, I did a fair amount of digging on it too, and while most expressed the opinion you came across, I did find a few that suggested that some variants of the virus could cause severe damage to a computer.

2. Upon further (unauthorized) use of some advanced recovery tools, the IT guy supporting me was able to discover that MOST of the files were still resident, intact, on my hard drive. The virus caused my computer to reboot uncontrollably. Every time it rebooted, it formatted anew several sectors of my hard drive. Fortunately, most of my files were resident on sectors that never got touched.

However, it wasn't easy even given that.

Out of 6 recovery options offered by this particular recovery software, 5 of 6 options failed to find any files. Only the last option worked. Ultimately, as of tonight, it appears I've recovered better than 90% of my files.

I owe my IT guy a case of beer!