HELP me plsss.... worm attacking

[dearde4n]

[Gecko]

Please download , unzip it to it's own folder.
Start HijackThis and select 'Do a system scan and save a logfile'
Now post the contents of the logfile back into this thread.

[dearde4n]

[Gecko]

[dearde4n]

[Gecko]

Does kaspersky give you the name and location of the infected file?

According to kaspersky the below files are created from the worm:
%Documents and Settings%\User\Local Settings\Application Data\csrss.exe
%Documents and Settings%\User\Local Settings\Application Data\inetinfo.exe
%Documents and Settings%\User\Local Settings\Application Data\lsass.exe
%Documents and Settings%\User\Local Settings\Application Data\services.exe
%Documents and Settings%\User\Local Settings\Application Data\smss.exe
%Documents and Settings%\User\Local Settings\Application Data\winlogon.exe
%Documents and Settings%\User\Start Menu\Programs\Startup\Empty.pif
%Documents and Settings%\User\Templates\WowTumpeh.com
%System%\<user name>'s Setting.scr
%Windir%\eksplorasi.pif
%Windir%\ShellNew\bronstab.exe

According to Symantic the below files are created from the worm:
· C:\Windows\PIF\CVT.exe
· %UserProfile%\APPDATA\IDTemplate.exe
· %UserProfile%\APPDATA\services.exe
· %UserProfile%\APPDATA\lsass.exe
· %UserProfile%\APPDATA\inetinfo.exe
· %UserProfile%\APPDATA\csrss.exe
· %UserProfile%\APPDATA\winlogon.exe
· %UserProfile%\Programs\Startup\Empty.pif
· %UserProfile%\Templates\A.kotnorB.com
· %System%\3D Animation.scr

Creates the folder:
%UserProfile%\Local Settings\Application Data\Bron.tok-24

Try booting into safe mode and Delete the listed files

To get regedit working again download this from Symantic:
http://securityresponse.symantec.com/av ... okExec.inf
save it to your desktop and then double click it

[dearde4n]

its seem llike they duplicate the folder name but in .exe files. such as C:\Documents and Settings\KPM_User\My Documents\My Music\My Music.exe. i also can get in to regedit and no prob with it. is only when start my pc, its came out. i have done AV scan during safe mode, but nothing.

[liljim]

Give this a try, it may help remove some of the infected files.

[dearde4n]