Overall Risk Level: 
W32.Mabezat.B can infect executable files and encrypt data files. W32.Mabezat.B worm spreads via removable drives and unsecured network shares. It will also modify Windows registry settings to disable certain functionalities.
Alias:
Damage Level: Low
Systems Affected: Windows
1. Temporarily Disable System Restore (Windows Me/XP). [how to]
2. Update the virus definitions.
3. Reboot computer in SafeMode [how to]
4. Run a full system scan and clean/delete all infected file(s)
5. Delete/Modify any values added to the registry. On Start Menu, click Run, type regedit on the field.
Navigate to and restore the following registry entry if required:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Current Version\Explorer\Advanced\”ShowSuperHidden” = “0″
6. Exit registry editor and restart the computer.
7. Find and delete the following files:
- %SystemDrive%\Documents and Settings\tazebama.dl_
- %SystemDrive%\Documents and Settings\hook.dl_
- %UserProfile%\Start Menu\Programs\Startup\zPharoh.exe
- %SystemDrive%\Documents and Settings\tazebama.dll
- [DRIVE]:\zPharaoh.exe
- [DRIVE]:\autorun
8. In order to make sure that threat is completely eliminated from your computer, carry out a full scan of your computer using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with Online Virus Scanner.
27 Responses for "W32.Mabezat.B"
This virus effected in our server. How can I remove this from the Server.
Your help requested
Dear sir,
We have the important system in our network & they have affected with tazabama virus please i need removal tool for tazebama virus urgently
Thanking You
We have tried this and work on Windows2000/XP, dont know if it will work on server.
1. Download Malwarebytes’ Anti-Malware (mbam-setup.exe) and save it on your Desktop.
2. After downloading, double-click on mbam-setup.exe to install the application.
3. Follow the prompts and install as “default” only
4. Before the installation completes, check on the following prompts:
– Update Malwarebytes’ Anti-Malware
– Launch Malwarebytes’ Anti-Malware
5. Click “Finish.” Program will run automatically and you will be prompt to update the program before doing a scan. Please update.
6. Scan your computer thoroughly.
7. When scanning is finished click on the “Show Results”
8. Make sure that all detected threats are marked, click on Remove Selected.
9. Restart your computer.
thanks i will try and will tell you about the result but if it doesn’t work i will show you ok
now i’m gonna take my chicha then go to the bed coz it’s too late here and i feel tiered today, i had many died in work this morning and i’m afraid will see them on my dream.
so tazebama and mr gate are permenantly in my computer playing cards and having alcooholic drinks.
The system restore tab is not available when I go to Properties of “My Computer”. However, I have gone to the registry and added the value as you recommend but am not sure it helps because I jumped the steps in between.
How to completely remove this worm from a flash drive. I used Norton but there was still some unresolved ones. How can I do this I need help.
Famart, you can use Flash Disinfector to remove threats on flash drives.
Hello,
I can’t follow step 5 as I’m not allowed to open regedit. I don’t see the start menu. It seems like I don’t have Administrator status anymore. I did a full virus analysis and deleted about 70 files but I can’t finish your protocol :(
Any idea?
Thanks a lot anyway.
Bye
comment supprimer le virus mabezat dans mon ordinateur
I followed through all the procedures, only that I didnt find the system restore tab on the properties of my computer, and I even couldnt user the microsoft guide to get to it, how ever I run/msconfig, and when to the system utility, and un checked the system restore service.
then followed through the steps, but again couldnt find the – %SystemDrive%\Documents and Settings\tazebama.dl_
- %SystemDrive%\Documents and Settings\hook.dl_
- %UserProfile%\Start Menu\Programs\Startup\zPharoh.exe
- %SystemDrive%\Documents and Settings\tazebama.dll
- [DRIVE]:\zPharaoh.exe
- [DRIVE]:\autorun
so I guessed it hadnt created those, or my Eset NOd 32 had deleted them, there fore I just continued with the procedures to the end, some body advise otherwise where need be please,
thanks
Rod
My windows 2003server is affected by Tezebama.dll anybody can help me
Hi
Our system has been hit by mabezat virus, all our computer which a connected to the server they cant access thier profiles it gives an error massege that says : local profile cannot be found you will currently be logged on a temporary file, I have update untivirus scanned the system got 1890 virus on the server.
Thanx and Regards
Thoko
Thanks for the great solution!
Our server computer had over 7500 viruses and 99 % of them were the Mabezat worm.. It has now been cleaned by this solution and by Avast! Antivirus.
I can only recommend Avast!, since it is a very powerful antivirus. And if you have Home Edition, you can use it freely without any payment. You only need to register with a received registration code (free of course).
Thanks again for this great solution.
– Robert
Hello Friends,
I our college all systems affected with tazebalm.dll virus.If i remove also automatically create each time when i used to execute Java Executable files……..iam unable to use Java due to this. Please give me a solution to permanently removing tazebalm.dll from all systems
Hi,
You will not beat this virus if you will not remove some of its files that were system, hidden and read-only.
You have to do it manually by going to following drives:
- %SystemDrive%\Documents and Settings\
- %UserProfile%\Start Menu\Programs\Startup\
- [RootDrive]:\
- [USB Drive]:\
1. Go to Start>Run and type “cmd” for command prompt
2. On each drive, type “attrib” to view attributed files.
3. To remove the attributes, type “-s -h -r filename”
4. Delete the file, “del filename”
5. After deleting all files, scan your computer with antivirus programs.
kaspersky does the whole trick. It saved me alot of stress, infact my sql had been taken plus my installation files.
Go for kaspersky do a full scan and restart your server.
and you will have sweet dreams !
I need help my laptop was infected by mabezat. I downloaded rmmabez.exe and scanned the PC. The virus was removed but my desktop is still not populated nor respond to left or right clicks. My taskbar is also not there.
I tried the system restore route but it did not help. I can only access programs and files via alt+del+ctrl new task route.
Can anyone help restore my computer.
Hi
I really need urgent help!!
I am a DJ with over 18 000 songs!!!
this ”mazebat” worm infected my pc because my norton was not updated!!
the pc was taken to IT experts..they removed it
BUT ALL MY MUSIC!! AND MUSIC APPS HAVE BEEN REMOVED BY THE VIRUS!!!
please I really need help on how to restore all the files
thanks in advance!
HJ
Sorry HJ for your loss of musicfiles but its not the virus
that has removed the songs, its the IT-”experts”.
hi i got a virus in my pc and i removed the virus using avg but i lost my file so any one can help me how to restore all the files
thanks in advance!
biniam
hi Biniam retrive ur deleted files r recover files from formated disk u use format recovery software it recover all d files :-@
I got infected too.
But before you do all these, you have to stop it first.
Open the notepad, and save the following as .bat:
TASKKILL /F /IM “tazebama.dl_”
%SystemDrive%\Documents and Settings\tazebama.dl_
%SystemDrive%\Documents and Settings\hook.dl_
%UserProfile%\Start Menu\Programs\Startup\zPharoh.exe
%SystemDrive%\Documents and Settings\tazebama.dll
c:-dir/ah
attrib -s -h -r C:\autorun.inf
attrib -s -h -r C:\zPharaoh.exe
del c:\autorun.inf
del c:\zPharaoh.exe
Depending on your drives letters, re-type the last 5 lines and consider changing the drive letter.
Note also that, there are files created on 5 levels of folders, each files has the name of its upper-level name, but with the extension .exe, in addition to other file taken from your system.
You can find them, if you do make a deep search with the following criteria:
- *.exe
- all computer drives
- size at most 152 KB
Sort the found files depending on the size
Delete all these files that has this size.
Remove the Win32/mabezat.B(tazebama.dl_)virus
Remov the win32/mabezat.B(tazebama.dl_)virus
sir,i’m problem wit my phone .i connected my nokia n73 t0 my friends computer,since then my phone can’t read its memory card. i formatted d phone memory and d memory card still yet no progress.pls i need your help.
What a relief to find this site! I was using my nokia E71 phone to browse the net when all of a sudden my memory card files were nowhere to be found! I checked my memory card status and dicovered that it was the way it was b4 it became corrupted. I formatted and tried to retrieve the data to no avail. when I take pictures itstores them but when I go to gallery I dont c them…pls help me I have a lot of my kids’ priceless pics that I dont want to lose. Tnx in advance.
Any Response?