Ik heb op een forum dit gevonden en heeft bij mij het probleem opgelost.
Here's a fix script for the virus. It's a VBS, so you'll probably need to disable your antivirus when running it.
Run it at your own risk. It cleaned my computer successfully, but I make not waranty or guarantee that it will work for everyone.
Steps to removal:
1 - Run updated Ad-Aware to remove IELoader
2 - Go to your Internet Settings Control Panel
3 - Click "General" tab
4 - Click "Settings" under "Temporary Internet Files" area
5 - Click "View Objects"
6 - If an item called "DownloadUL" exists, right click it, and click "Remove"
7 - Close all windows.
8 - Highlight and Copy all the text below between the "============" lines
9 - Open notepad
10 - Paste the copied text into notepad
11 - Save the file to your desktop as a .vbs file
12 - Double click the newly created file on your desktop and step through each prompted step. Be sure to read the alerts for instructions.
13 - Reboot.
You Should be cleaned after that!
'===========================================
Sub Main()
Set fso = CreateObject("Scripting.FileSystemObject")
Set sys32dir = fso.getFolder("C:\Windows\System32")
Set sysdir = fso.getFolder("C:\Windows")
Set wshell = CreateObject("WScript.Shell")
if msgbox("This script will try to remove zzb.exe and related Trojans. Press 'OK' to continue.", vbOkCancel) = vbCancel Then Exit Sub
'--- Delete loader apps ---
MsgBox("Deleting Trojan executables, ocx's and data files")
if fso.fileexists("C:\Windows\System32\zzb.exe") then
fso.deletefile "C:\Windows\System32\zzb.exe"
msgbox("C:\Windows\System32\zzb.exe DELETED!")
end if
if fso.fileexists("C:\Windows\System32\py.exe") then
fso.deletefile "C:\Windows\System32\py.exe"
msgbox("C:\Windows\System32\py.exe DELETED!")
end if
if fso.fileexists("C:\Windows\System32\msbb.exe") then
fso.deletefile "C:\Windows\System32\msbb.exe"
msgbox("C:\Windows\System32\msbb.exe DELETED!")
end if
if fso.fileexists("C:\Windows\System32\mstbl.ocx") then
fso.deletefile "C:\Windows\System32\mstbl.ocx"
msgbox("C:\Windows\System32\mstbl.ocx DELETED!")
end if
if fso.fileexists("C:\Windows\System32\mslib.dat") then
fso.deletefile "C:\Windows\System32\mslib.dat"
msgbox("C:\Windows\System32\mslib.dat DELETED!")
end if
if fso.fileexists("C:\Windows\System32\mslink32.dat") then
fso.deletefile "C:\Windows\System32\mslink32.dat"
msgbox("C:\Windows\System32\mslink32.dat DELETED!")
end if
if fso.fileexists("C:\Windows\msbb.exe") then
fso.deletefile "C:\Windows\msbb.exe"
msgbox("C:\Windows\msbb.exe DELETED!")
end if
if fso.fileexists("C:\Windows\bridge.exe") then
fso.deletefile "C:\Windows\bridge.exe"
msgbox("C:\Windows\bridge.exe DELETED!")
end if
'--- Clean Registry ---
msgbox("Cleaning the registry.")
on error resume next
wshell.RegDelete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zzb"
wshell.RegDelete "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\zzb"
on error goto 0
'--- Find DLL's ---
msgbox("Searching for dll files associated with these trojans.")
Dim aryFiles
aryFiles = Array()
Dim found
found = 0
call findSuspectFiles(aryFiles, sysdir, found)
call findSuspectFiles(aryFiles, sys32dir, found)
MsgBox(found & " suspicious files found.")
If found = 0 then exit sub
MsgBox("You will now be prompted to confirm whether " & vbcrlf _
& "or not to delete and unregister each dll. " & vbcrlf _
& "A backup copy will be created in the current directory " & vbcrlf _
& "should you decide to restore the files. Use caution when " & vbcrlf _
& "deleting these files. Any filename that is somewhat comprehendable, do not delete.")
on error resume next
fso.CreateFolder ".\RemoveDLL_Backup"
on error goto 0
for i = 0 to Ubound(aryFiles)
if msgbox("Remove " & aryFiles(i), vbYesNo) = vbYes Then
select case mid(aryFiles(i), InStrRev(aryFiles(i), "."), 4)
case ".dll"
wshell.Exec("regsvr32 -u " & aryFiles(i))
fso.CopyFile aryFiles(i), ".\RemoveDLL_Backup\" & mid(aryFiles(i), InStrRev(aryFiles(i), "\"), len(aryFiles(i))) & "_"
fso.DeleteFile aryFiles(i)
case ".exe"
fso.CopyFile aryFiles(i), ".\RemoveDLL_Backup\" & mid(aryFiles(i), InStrRev(aryFiles(i), "\"), len(aryFiles(i))) & "_"
fso.DeleteFile aryFiles(i)
End Select
End If
Next
End Sub
sub findSuspectFiles(aryFiles, folder, found)
Set regEx = New RegExp
regEx.Pattern = "(^([a-z]){8}\.((dll)|(exe)))"
regEx.IgnoreCase = false
regEx.Global = false
for each Files in folder.files
set matches = regEx.Execute(Files.name)
tFound = false
for each item in matches
tFound = true
next
if tFound and ((Files.name <> "mscories.dll") AND (Files.name <> "hostname.exe")) then
select case mid(Files.name, InStrRev(Files.Name, "."), 4)
case ".dll"
if Files.size = 106496 then
redim preserve aryFiles(UBound(aryFiles) + 1)
aryFiles(UBound(aryFiles)) = Files.path
found = found + 1
end if
case ".exe"
if Files.size = 7680 then
redim preserve aryFiles(UBound(aryFiles) + 1)
aryFiles(UBound(aryFiles)) = Files.path
found = found + 1
end if
End Select
End If
Next
end sub
Main()
'===================================
Suc6
/u/12977/crop63974828d86af_cropped.png?f=community)
/u/53007/DustPuppy.png?f=community)
/u/28468/librarian2.png?f=community)
/u/18178/logo-60x60.png?f=community){kind=logo}
dacht, linkje is ook wel makkelijk.
