# Forum in English  > Malware Removal Service  >  Email-Worm.Win32.Brontok.cd

## maximus222

Hello,

Its been a while now I cant remove from my PC this worm, and I have tried a lot of things.

I hope you can help me with this. 

Alos recently the AVP Removal tool notifies me of the worm and when I keep deleting it, it then restarts the PC. I hope thats a dissinfection feature.

Many thanks,
Gentrit :Huh: 

Included is the system information produced from the manual dissinfection tool.

----------


## olejah

Close/unload all the programs 

Switch off:
- Antivirus and, if you have - Firewall.

- Execute following script in Manual Healing



```
begin
 SearchRootkit(true, true);
 SetAVZGuardStatus(true);
 TerminateProcessByName('c:\documents and settings\acer\local settings\application data\lsass.exe');
 QuarantineFile('c:\documents and settings\acer\local settings\application data\lsass.exe','');
 TerminateProcessByName('c:\documents and settings\acer\local settings\application data\services.exe');
 QuarantineFile('c:\documents and settings\acer\local settings\application data\services.exe','');
 TerminateProcessByName('c:\documents and settings\acer\local settings\application data\winlogon.exe');
 QuarantineFile('c:\documents and settings\acer\local settings\application data\winlogon.exe','');
 QuarantineFile('C:\Documents and Settings\Acer\Start Menu\Programs\Startup\Empty.pif','');
 QuarantineFile('C:\Documents and Settings\Acer\Local Settings\Application Data\smss.exe','');
 DeleteFile('C:\Documents and Settings\Acer\Local Settings\Application Data\smss.exe');
 DeleteFile('C:\Documents and Settings\Acer\Start Menu\Programs\Startup\Empty.pif');
 DeleteFile('c:\documents and settings\acer\local settings\application data\winlogon.exe');
 DeleteFile('c:\documents and settings\acer\local settings\application data\services.exe');
 DeleteFile('c:\documents and settings\acer\local settings\application data\lsass.exe');
 QuarantineFile('c:\windows\eksplorasi.exe','');
 DeleteFile('c:\windows\eksplorasi.exe');  
 BC_ImportAll;
 ExecuteSysClean;
 ExecuteWizard('TSW',2,2,true);
 ExecuteRepair(1);
 ExecuteRepair(8);
 ExecuteRepair(16);
 ExecuteRepair(17);
 BC_Activate;
 RebootWindows(true);
end.
```

After reboot:
- Execute following script in Manual Healing



```
begin
CreateQurantineArchive('C:\quarantine.zip');    
end.
```

- Upload the C:\quarantine.zip here: upload_virus_eng.
- Make a new log file and Attach a new log to your new post..

----------


## maximus222

Hello Olejah,

Thank you for your response.

I did as instructed and we have the following:

Upload result

File saved as	100928_161622_quarantine_4ca1dc96d90a4.zip
File size	3652
MD5	c5b1e3db481d0d05da8beee8add5a519
File uploaded, thank you! (of the  quarrantine.zip)

and the log file in the attachment.

Thank you!

----------


## olejah

Hello, now I can't see any suspicious files in the logfile. Is there any problem with system now?

----------


## maximus222

I dont know but I still get the .exe virus related application on the shard documents folder.

I am inlcuding a log file I have just done as well.

Thanks--Gentrit

----------


## maximus222

basically this thing keeps generating itself again and again even after i scan and remove infected items in safe mode and fixing the registry (read how to do it from internet, on how to remove brontok.C worm). it starts appearing again after a while, maybe I am not hitting the source of infection or something.

----------


## olejah

Make a log of Malwarebytes' Anti-Malware

----------


## maximus222

Ok, here is the malwarebytes lof file.

I hope this can help.

Thanks
Gentrit :Smiley:

----------


## olejah

Alright, now we should delete everything, that was found. And repeat MBAM's log again.

----------


## maximus222

Goodmorning,

Sorry for the delayed reply, just came to my pc (at work).

Just did the scan again removed the files with malwarebytes antimalware and restarted the pc as instructed by the program. Started again the scan and here is the log again showing some infected files right after start up.
 :Sad:

----------


## olejah

Good morning, looks like MBAM couldn't see all files of Brontok. Let's give MBAM one last chance - delete everything it found and check if malware still exists.

----------


## maximus222

I am doing the scan again and I will delete what it finds then I will restart the pc and do the scan again and upload the log file here as soon as it finishes.

Gentrit

----------


## maximus222

Hello,

Just finished the scan for the second time and the log doesnt show any infections, but, the infected files are still there (at the shared documents). 

Maybe at the time the MBAM was scanning those folders the antivirus deleted them because they keep appearing and it deletes them time after time.

So the infection is still there mate.

Gentrit

----------

