worm.BAT.autorun.w

[cippa]

I have a problem with worm.BAT.autorun.w.
At moment removal tools is able to identified the worm but not to disinfect.

I attach the last report of removal tools. I hope someone coul'd help me.

by
cippa

[RiC]

Execute in AVPTools script from box below


begin
RegKeyIntParamWrite('HKEY_LOCAL_MACHINE', 'System\CurrentControlSet\Services\CDROM','AutoRun ', 0);
QuarantineFile('C:\WINDOWS\sys32_.exe','');
QuarantineFile('c:\windows\installer\24ha12\inet\s lp2.exe','');
QuarantineFile('c:\windows\installer\24ha12\inet\i nt2com.exe','');
QuarantineFile('c:\windows\installer\24ha12\cmp\in sdr.exe','');
QuarantineFile('D:\autorun.inf','');
QuarantineFile('G:\autorun.inf','');
QuarantineFile('H:\autorun.inf','');
DeleteFile('D:\autorun.inf');
DeleteFile('G:\autorun.inf');
DeleteFile('H:\autorun.inf');
DeleteFile('C:\WINDOWS\sys32_.exe');
ExecuteSysClean;
RebootWindows(true);
end.

After reboot pack (with pass 'virus') and upload "Qurantine" folder here (http://virusinfo.info/upload_virus_eng.php?tid=24215) to virus analist.
Uninstall old AVPTools, download, install new version of AVPTools and repeat log.

[cippa]

Ric,
thanks very much for the procedure.
I will try to apply and communicate the effects.