how to remove the following

[kyeo.9]

system info - win xp professional

win xp pro 2002 sp 3
intel core quad 2.66hz
1.87 gig of ram

hope you can help

thanks

[Rene-gad]

Hello,
Close/unload all the programs excepted AVZ and Internet Explorer

Switch off:
- Antivirus and and, if you have - Firewall.
- System Restore

- Execute following script in Manual Healing

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
 QuarantineFile('H:\autorun.inf','');
 QuarantineFile('ZASRAKOMONDOHUI31338.EXE','');
 QuarantineFile('RapportMgmtService.exe','');
 QuarantineFile('RapportService.exe','');
 QuarantineFile('C:\WINDOWS\system32\sdra64.exe','');
 DeleteFile('C:\WINDOWS\system32\sdra64.exe');
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RapportMgmtService.exe');      
 RegKeyDel('HKEY_LOCAL_MACHINE','SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RapportService.exe');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
RebootWindows(true);
end.

After reboot:
- Execute following script in Manual Healing

begin
CreateQurantineArchive('C:\quarantine.zip');    
end.

and upload the C:\quarantine.zip here: http://virusinfo.info/upload_virus_eng.php?tid=74256
- Remove Bonjour: http://virusinfo.info/showthread.php?t=42263
- Repeat a log file of AVPTool.
- Make a log file of Hijackthis
- Make a log file of Malwarebytes Antimalware (don't remove anything!).
- Attach all logs to your new post.

[kyeo.9]

Thanks for the advice, here are the reports you asked for.


kyeo

[Rene-gad]

here are the reports you asked for.

Not quite correct: you have to make and attach the same log as at the very beginning: avptool_sysinfo.zip

[kyeo.9]

here is the sysinfo file

[Rene-gad]

here is the sysinfo file

No, it's the same log as in your 1st post! We should be able to define the difference between the log FOR healing and the log AFTER healing. Download the actual version of AVPTool , make a NEW log and attach it.

[CyberHelper]

Статистика проведенного лечения:

• Получено карантинов: 1
• Обработано файлов: 11
• В ходе лечения вредоносные программы в карантинах не обнаружены