KIS could not delete rootkit virus

I used KIS since Feb 19, 2010. Until now I could not delete the following virus :

C:\WINDOWS\system32\drivers\ejxtwmfy.sys
contains virus
Rootkit.Win32.Agent.bdkq

and

C:\WINDOWS\system32\drivers\ndis.sys
contains virus
Virus.Win32.Protector.e

attached is report using Kaspersky Virus Removal Tool

Close/unload all the programs excepted AVZ and Internet Explorer

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore


- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
QuarantineFile('C:\WINDOWS\system32\wsnpoema.exe','');
QuarantineFile('C:\WINDOWS\system32\Drivers\NDIS.sys','');
QuarantineFile('C:\WINDOWS\system32\Drivers\ejxtwmfy.sys','');
DeleteFile('C:\WINDOWS\system32\Drivers\ejxtwmfy.sys');
DeleteFile('C:\WINDOWS\system32\wsnpoema.exe');
DeleteService('ejxtwmfy);
DeleteService('lfozeixaw);
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\ejxtwmfy);
RegKeyResetSecurity('HKLM','SYSTEM\CurrentControlSet\Services\lfozeixaw);
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.
[/CODE]
After reboot:
- Replace file C:\WINDOWS\system32\Drivers\NDIS.sys with a system file from Windows CD or from any similar system. For replacing pls. use either recovery console of Windows or any Live CD or re-mount your hard disk as slave into any other PC. Ask your [url]http://www.google.com.my[/url] about details.
Boot your system from hard disk with replaced C:\WINDOWS\system32\Drivers\NDIS.sys
- [URL="http://virusinfo.info/showthread.php?t=9207"]Execute following script[/URL] in Manual Healing
[CODE]begin
CreateQurantineArchive('C:\quarantine.zip');
end.
[/CODE]
- Upload the C:\quarantine.zip here: [url]http://virusinfo.info/upload_virus_eng.php?tid=74496[/url]
- Install Service Pack 3 and all subsequent updates.
- Install Internet Explorer 8
- Make a new logfile of AVPTool and attach it to your next post. REM: You don't need to use AVPTool, you could make just the same log form Kaspersky Interface. See here for more details: [url]http://forum.kaspersky.com/index.php?showtopic=69276&st=0&p=678326&#entry678326[/url]

[B][SIZE=3]Rene-gad[/SIZE][/B] , thanks for your prompt reply

The steps given is quite risky for me because I'm not good in repairing windows.

Can I just do nothing and ignore the virus? Until now it does not seem to do anything really harmful to my computer

[QUOTE=frdata;610329]
The steps given is quite risky for me because I'm not good in repairing windows.[/QUOTE]Than you've to flatten and rebuild your system - it's more simple.
Read here: [url]http://technet.microsoft.com/de-de/library/cc512587%28en-us%29.aspx[/url]
Read here: [url]http://technet.microsoft.com/de-de/library/cc722487%28en-us%29.aspx[/url] beginning from [I][U]If a bad guy can persuade you to run his program on your computer, it's not your computer anymore [/U][/I]
[QUOTE=frdata;610329]
Until now it does not seem to do anything really harmful to my computer[/QUOTE]Read about [URL="http://en.wikipedia.org/wiki/Rootkit"]Rootkits[/URL]

[QUOTE=Rene-gad;610343]Than you've to flatten and rebuild your system - it's more simple.
Read here: [URL]http://technet.microsoft.com/de-de/library/cc512587%28en-us%29.aspx[/URL]
Read here: [URL]http://technet.microsoft.com/de-de/library/cc722487%28en-us%29.aspx[/URL] beginning from [I][U]If a bad guy can persuade you to run his program on your computer, it's not your computer anymore [/U][/I]
Read about [URL="http://en.wikipedia.org/wiki/Rootkit"]Rootkits[/URL][/QUOTE]

Thanks again. It really helps.

Ok, got rid of the rootkit using tdsskiller.exe downloaded from Kaspersky technical help. Now only left is :

C:\WINDOWS\system32\drivers\ndis.sys
contains virus
Virus.Win32.Protector.e

Does this virus pose a high treat?

[QUOTE=frdata;610910]
Does this virus pose a high treat?[/QUOTE][url]http://www.threatexpert.com/report.aspx?md5=287b7099b4562f124daf321ef2cc065c[/url]