PCTech Forums

Please download , unzip it to it's own folder.
Start HijackThis and select 'Do a system scan and save a logfile'
Now post the contents of the logfile back into this thread.

Does kaspersky give you the name and location of the infected file?

According to kaspersky the below files are created from the worm:
%Documents and Settings%\User\Local Settings\Application Data\csrss.exe
%Documents and Settings%\User\Local Settings\Application Data\inetinfo.exe
%Documents and Settings%\User\Local Settings\Application Data\lsass.exe
%Documents and Settings%\User\Local Settings\Application Data\services.exe
%Documents and Settings%\User\Local Settings\Application Data\smss.exe
%Documents and Settings%\User\Local Settings\Application Data\winlogon.exe
%Documents and Settings%\User\Start Menu\Programs\Startup\Empty.pif
%Documents and Settings%\User\Templates\WowTumpeh.com
%System%\<user name>'s Setting.scr
%Windir%\eksplorasi.pif
%Windir%\ShellNew\bronstab.exe

According to Symantic the below files are created from the worm:
· C:\Windows\PIF\CVT.exe
· %UserProfile%\APPDATA\IDTemplate.exe
· %UserProfile%\APPDATA\services.exe
· %UserProfile%\APPDATA\lsass.exe
· %UserProfile%\APPDATA\inetinfo.exe
· %UserProfile%\APPDATA\csrss.exe
· %UserProfile%\APPDATA\winlogon.exe
· %UserProfile%\Programs\Startup\Empty.pif
· %UserProfile%\Templates\A.kotnorB.com
· %System%\3D Animation.scr

Creates the folder:
%UserProfile%\Local Settings\Application Data\Bron.tok-24

Try booting into safe mode and Delete the listed files

To get regedit working again download this from Symantic:
http://securityresponse.symantec.com/av ... okExec.inf
save it to your desktop and then double click it

its seem llike they duplicate the folder name but in .exe files. such as C:\Documents and Settings\KPM_User\My Documents\My Music\My Music.exe. i also can get in to regedit and no prob with it. is only when start my pc, its came out. i have done AV scan during safe mode, but nothing.

Give this a try, it may help remove some of the infected files.