Zzffbn.exe, what kinda malware is this ?

Fr0st · Jan 26, 2005

Hi,

Zzffbn.exe keeps running in the background everything I restart. Anyone have info on what kind of malware it is ?

This is my HJT log:

Logfile of HijackThis v1.99.0
Scan saved at 8:44:13 PM, on 1/26/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Edit by chaslang: Unrequested inline log deleted. Please follow forum guidelines.

jarcher · Jan 26, 2005

have you already gone through this sticky if not please do so. . .
READ ME FIRST BEFORE ASKING FOR SUPPORT: Basic Spyware, Trojan And Virus Removal:
if you have double check everything and make sure you did do everything
and all software is up to date(do the online scans)

NO HIJACK THIS LOG FILES BEFORE READING THIS: HJT Tutorial & LOG File Posting:
*Note that your HijackThis should be up-to-date (v1.99) and MUST be extracted to its own safe folder - C:\Program Files\HijackThis! Please do this!!!*
remember to close all running and tray apps. and all windows(including this one)before scaning

if you have, successfuly
How to Protect yourself from malware!

ME: Virtumundo Problems/Resolution Threads

chaslang · Jan 26, 2005

Complete the READ ME that jarcher has pointed you towards.

But before you even bother posting another HJT log make sure you do the stuff below:

Goto Add/Remove programs and uninstall Messenger Plus! 3 It is the cause of a lot of your problems.

Copy the contents of the Quote Box below to Notepad. Then click File and then Save As. Change the Save as Type to All Files. Name the file move.reg and then click save. (make sure you save it somewhere you can find it. Saving it to your Desktop may make that easy.)

REGEDIT4
[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\frame.crazywinnings.com]
"*"=dword:00000002

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\frame.crazywinnings.com]
"*"=dword:00000004

[-HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\awmdabest.com]
"*"=dword:00000002

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\awmdabest.com]
"*"=dword:00000004

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\frame.crazywinnings.com]
"*"=dword:00000002
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\frame.crazywinnings.com]
"*"=dword:00000004

[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\awmdabest.com]
"*"=dword:00000002
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\awmdabest.com]
"*"=dword:00000004
Click to expand...

Double-click on the move.reg file on your desktop (or locate it with Windows Explorer and double click on it if not saved to the Desktop) and when it prompts to merge say yes.

Exit all browsers and run HijackThis and have it FIX the following lines:
O15 - Trusted IP range: 206.161.125.149
O15 - Trusted IP range: (HKLM)

Log in or Sign up

Zzffbn.exe, what kinda malware is this ?

Fr0st Private E-2

jarcher I can't handle a title

chaslang MajorGeeks Admin - Master Malware Expert Staff Member