The following script is for removal of the x-/z-/I-connect dialer malware. I have tested it and it removes the dialer.
The script contains a reference to a virtual Drive, in this instance its the "E" Drive. You will need to do a registry scan for the lax.exe file to see what the designated drive is. Change the virtual drive letter in the script to correspond accordingly.
In this instance there are no other drives present other than A;C and D. Therefore it has defaulted to "E".
You will need to run the script in scanning software that has the ability to enter custom script. I use a specific software that is specifically used in my business. I adhere to the forums rules in not publicising or promoting software. If you run into difficulties in utilising the script, the only advice I can offer is you e-mail me and I will point you in the right direction. If you read the script text you will find direction.
Script as follows:
begin
SearchRootkit(true, true); SearchRootkit (true, true);
SetAVZGuardStatus(true); SetAVZGuardStatus (true);
DelCLSID('67KLN5J0-4OPM-00WE-AAX5-74CC2A323342'); DelCLSID ('67KLN5J0-4OPM-00WE-AAX5-74CC2A323342 ');
DelCLSID('12LOP3S8-1VRX-81VS-JKL6-61OP5G7774441'); DelCLSID ('12LOP3S8-1VRX-81VS-JKL6-61OP5G7774441 ');
QuarantineFile('E:\WIN\DOWS\LAX.exe',''); QuarantineFile ( 'E: \ WIN \ DOWS \ LAX.exe','');
QuarantineFile('C:\BIN\RECYCLE\Bin.exe',''); QuarantineFile ( 'C: \ BIN \ RECYCLE \ Bin.exe','');
QuarantineFile('C:\WIN\DOWS\LAX.exe',''); QuarantineFile ( 'C: \ WIN \ DOWS \ LAX.exe','');
DeleteFile('C:\WIN\DOWS\LAX.exe'); DeleteFile ( 'C: \ WIN \ DOWS \ LAX.exe');
DeleteFile('C:\BIN\RECYCLE\Bin.exe'); DeleteFile ( 'C: \ BIN \ RECYCLE \ Bin.exe');
DeleteFile('E:\WIN\DOWS\LAX.exe'); DeleteFile ( 'E: \ WIN \ DOWS \ LAX.exe');
DeleteFile('E:\autorun.inf'); DeleteFile ( 'E: \ autorun.inf');
BC_ImportDeletedList; BC_ImportDeletedList;
ExecuteSysclean; ExecuteSysclean;
BC_Activate; BC_Activate;
RebootWindows(true); RebootWindows (true);
end. end.
Good luck
Sign up with Google