symbooter

[jdukezu]

I can't to remover this virus

c:\windows\system32\symbooter.exe
Script: Quarantine, Delete, BC delete, Terminate

[RiC]

Welcome!
Please attach full log (avptool_syscheck.zip or virusinfo_syscheck.zip) to message.

[jdukezu]

I can't to remover this virus

c:\windows\system32\symbooter.exe
_______
thanks, by their answer and help


Jduquezu

[RiC]

You PC virtual (SUN Vbox) - we test AVPTool ?

Script for remove symbooter.exe -

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
QuarantineFile('C:\WINDOWS\system32\Drivers\cercsr6.sys','');
QuarantineFile('c:\windows\system32\symbooter.exe','');
DeleteFile('c:\windows\system32\symbooter.exe');
BC_ImportAll;
ExecuteSysClean;
CreateQurantineArchive(GetAVZDirectory+'quarantine.zip');
BC_Activate;
RebootWindows(true);
end.

Script for clear system, after remove symbooter -

begin
ExecuteRepair(6);
ExecuteRepair(10);
ExecuteRepair(11);
ExecuteRepair(13);
ExecuteRepair(17);
RebootWindows(false);
end.

Please upload qurantine.zip here for virus analysts.

Repeat log for check if you want.

[jdukezu]

thank you very much,