Xpounded Free6 Removal

You should back up your registry before applying this fix. As with all registry alterations it's better to be safe than sorry.

This script will build a reg file that kills the Free6 popup generator: vbsys2.dll
To Use: Copy the code locally to your desktop and then double-click to run the application. If the script finds free6 it will generate two files with the same name. One, a text file holding removal instructions. The other, a Reg file that can be used to rid yourself of the popups.
Notes...
Always open and read a generated Reg file before using it *

This script provides a salve for the symptoms only - no more popups.

Check All Startup folders for insurgent files.

* = Open the Reg File with notepad to read it.

Free6 relies on the file vbsys2.dll found in the Systems System32 folder. This dll is registerd to the system as an inprocess-server shell extension library and used through smss.exe
A fast way to get rid of the file (vbsys2.dll) and its functionality is to use the script below. It will 'manually' (by automation that is) unregister the vbsys file from your system.
Required Steps

Copy the code below to your desktop and run it.

Remove Start-up files from 'All Users' Start Folder (or where dropper is found)
Restart Your System

Remove vbsys.dll

You are now free of the Free6 popups.
Last Note: The entries for vbsys2.dll will be re-entered into the registry by the dropper trojan if you do not remove it. Most liky in the Startup Folder for 'All Users'. The popups will not return as long as vbsys2.dll is removed from your system.

Other possible routs for the return of the registry entries: Windows System Restore. Save this file as Free6_Cleaner.vbs Mention Us

Select All

Dim instructions
Dim notice
instructions = "Free6_Cleaner is a VBS file that will create a *.REG file that will help you clean your system of Free6" & vbcrlf
instructions = instructions & "The *.Reg file is/has-been created on your dektop." & vbcrlf
instructions = instructions & "To clean Free6:" & vbcrlf
instructions = instructions & vbtab & "1. Double-Click the file 'CleanFree6.reg' located on your Desktop." & vbcrlf
instructions = instructions & vbtab & "2. Restart You System." & vbcrlf
instructions = instructions & vbtab & "3. Browse to %SystemRoot%\System32\vbsys2.dll" & vbcrlf
instructions = instructions & vbtab & vbtab & "(%SystemRoot% is a short way to say your system folder: usually c:\windows)" & vbcrlf
instructions = instructions & vbtab & "4. Rename or/and Move/Remove the file vbsys2.dll" & vbcrlf
instructions = instructions & vbtab & "5. The Free6 popups should be gone! Mention us." & vbcrlf
instructions = instructions & vbtab & "Xpounded."
notice = "It appears that your system is free of Free6."
Function RegRead(key)
	Dim Sh, sRet
	Set Sh = CreateObject("WScript.Shell")
	sKey =  key
	On Error Resume Next
	sRet = Sh.RegRead(sKey)
	On Error Goto 0
	Set Sh = Nothing
	RegRead = sRet
End Function

Function RegFileToCleanFree6(strCLSSID)
	Dim ret
	ret="REGEDIT4" & vbcrlf
	ret=ret & ";Xpounded File to Remove Probable Free6 Hijacker vbsys2" & vbcrlf
	ret=ret & ";" & vbcrlf
	ret=ret & ";HKEY_CLASSES_ROOT\CLSID\" & strCLSSID & "\InProcServer32" & vbcrlf
	ret=ret & ";REG_EXPAND_SZ @ C:\WINDOWS\System32\vbsys2" & vbcrlf
	ret=ret & "[HKEY_CLASSES_ROOT\CLSID\" & strCLSSID & "\InProcServer32]" & vbcrlf
	ret=ret & "@=-"  & vbcrlf
	ret=ret & "[-HKEY_CLASSES_ROOT\CLSID\" & strCLSSID & "\InProcServer32]" & vbcrlf & vbcrlf
	ret=ret & ";HKEY_CLASSES_ROOT\CLSID\" & strCLSSID & vbcrlf
	ret=ret & ";REG_EXPAND_SZ @ System Check Application" & vbcrlf & vbcrlf
	ret=ret & "[HKEY_CLASSES_ROOT\CLSID\" & strCLSSID & "]" & vbcrlf
	ret=ret & "@=-" & vbcrlf
	ret=ret & "[-HKEY_CLASSES_ROOT\CLSID\" & strCLSSID & "]" & vbcrlf & vbcrlf
	ret=ret & ";HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\" & strCLSSID & "\InProcServer32" & vbcrlf
	ret=ret & ";REG_EXPAND_SZ @ C:\WINDOWS\System32\vbsys2" & vbcrlf
	ret=ret & "[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\" & strCLSSID & "\InProcServer32]" & vbcrlf
	ret=ret & "@=-" & vbcrlf
	ret=ret & "[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\" & strCLSSID & "\InProcServer32]" & vbcrlf & vbcrlf
	ret=ret & ";HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\" & strCLSSID & vbcrlf
	ret=ret & ";REG_EXPAND_SZ @ System Check Application" & vbcrlf
	ret=ret & "[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\" & strCLSSID & "]" & vbcrlf
	ret=ret & "@=-" & vbcrlf
	ret=ret & "[-HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\" & strCLSSID & "]" & vbcrlf & vbcrlf
	ret=ret & ";HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad" & vbcrlf
	ret=ret & ";REG_SZ SystemCheck2 " & strCLSSID & vbcrlf
	ret=ret & "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]" & vbcrlf
	ret=ret & chr(34) & "SystemCheck2" & chr(34) & "=-" & vbcrlf & vbcrlf
	ret=ret & ";HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved" & vbcrlf
	ret=ret & ";REG_SZ SystemCheck2 " & strCLSSID & vbcrlf
	ret=ret & "[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved]" & vbcrlf
	ret=ret & chr(34) & "SystemCheck2" & chr(34) & "=-" & vbcrlf
	RegFileToCleanFree6 = ret
End Function

Sub saveFile(path,sContent)
	Dim result
	Set result = fso.createTextFile(path,True)
	result.Write sContent
	result.Close
	Set result = Nothing
End Sub

Dim fso, desktop, WshShell
set WshShell = WScript.CreateObject("WScript.Shell")
desktop = WshShell.SpecialFolders("Desktop")
set WshShell = Nothing
Set fso = createObject("Scripting.FileSystemObject")

free6CLSSID=RegRead("HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\SystemCheck2")
If free6CLSSID <> "" Then
	regFile = RegFileToCleanFree6(free6CLSSID)
	saveFile desktop & "\CleanFree6.reg", regFile
	saveFile desktop & "\CleanFree6.txt", instructions
Else
	saveFile desktop & "\CleanFree6.txt", notice
End If
msgbox "Read the 'CleanFree6.txt' instructions on your Desktop to Clean free6 from your system",vbokonly,"Completed"

No HTML to View

- Copyright 2003-2006 Xpounded -
All JS code developed by Xpounded is developed in RHSCoder.
All VBS code developed by Xpounded is developed in VBS QuickDev IDE, or RHSCoder.
Feedback