Feb 082009

Windows Firewall pop up message and throws me out of website

There is a pop up message saying “Security Center Alert”
To help protect your computer , Windows Firewall has blocked activity of harmful software.
Then there is a line seperation_______________
Then it says:Do You want to block this suspicious Software?
Name: Sinowal.Trojan
Risk Level: High
Description: Sinowal.Trojan is a Trojan program that records keystrokes and takes screen shots of the computer. Stealing personal financial Information.
Then it gives you three buttons to click on:
“Keep Blocking”(which is grayed out and you can’t click on it anyway)
“Unblock” (which is also grayed out and you can’t click on it)
“Enable Protection”(which is one you can click on and it takes you to a website called “Safe Soft Reviews” where they try to sell you some security software programs)
Now back to the pop up…underneath the “buttons” it says the following:
Windows Firewall has detected unauthorized activity, but unfortunately it can not help you remove viruses. Keyloggers and other spyware threats that steal your personal information from your computer.
Next is an underlined link, it says:
“Click to download and activate protection”

Whenever you open IE you should see security alert center popup with sinowal.trojan on it


Solution 1

Go to C:\documents and settings\username\application data\Google
there is a xxxxxx.exe file in there with a security icon. that is it. mine was named something like pfysw721318.exe.
Delete that exe file.


I wasn’t able to delete this file with the following error


You can downloaded killbox application from here and selected delete file upon reboot.

Solution 2

Download combofix from here and run

Incoming search terms:

  8 Responses to “How to Remove safesoft trojan (WIN32.Zafi.B virus)”

  1. The file can be deleted after restarting windows in safe mode.

  2. Its exactly where you said and I successfully deleted it, thank you!

  3. HI There!

    I a having trouble with Sfae Soft Pop up too. I am not good with computerrs and am having troble finding documents and settings. Can you help me?

    Thank you,

  4. Thank you very much, Killbox did not manage to delete it, but combofix did just fine. I can’t thank you enough. It is people like you that restor my faith in humanity. THANK YOU

  5. I am also having trouble finding the files in google. If you can at all help me please do. Man I hate this thing…

  6. Solution 2 works perfect!

    Thanks so much!!! I think everything is working properly again!!!

    really appreciate your help!

  7. Solution 2 worked for me too.. Nice one.

  8. l dont appear to have a desktop icon for the product l purchased which means l cant use the product, can you help me.


    pj williams

 Leave a Reply



You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>