Worm.Win32.Mabezat... need to remove virus.

[mervyne]

Sir/Madam,
Please assist me in removing this virus from my server.
Attached is the file: avptool_sysinfo.

Thank you.

[Rene-gad]

Hello,
I miss Service Pack 2 @ your system.

Switch off/Disable:
- Antivirus and and, if you have - Firewall.

- Execute following script in Manual disinfection

begin
SearchRootkit(true, true);
SetAVZGuardStatus(True);
ClearQuarantine;
QuarantineFile('C:\WINDOWS\system32\inetsrv\iisrstas.exe','');
 QuarantineFile('C:\WINDOWS\system32\userinit.exe','');
 QuarantineFile('C:\TKSQL\day.bat','');
 QuarantineFile('C:\TKSQL\autopoll.bat','');
 QuarantineFile('C:\autorun.inf','');
 QuarantineFile('C:\zPharaoh.exe','');
 QuarantineFile('D:\autorun.inf','');
 DeleteFile('C:\autorun.inf');
 DeleteFile('C:\zPharaoh.exe');
 DeleteFile('D:\zPharaoh.exe');
BC_ImportAll;
ExecuteSysClean;
BC_Activate;
SetAVZPMStatus(True);
RebootWindows(true);
end.

After reboot execute following script in Manual disinfection

begin
CreateQurantineArchive('C:\quarantine.zip');
end.

and upload the C:\quarantine.zip over the link Upload quarantined files on the top of this page.

- Repeat a log file of AVPTool.
- Attach a log to your new post..

[mervyne]

I thank you very much for speedy reply. I am very new to the KAV and server environment and also to executing of "scrpits". Can you point me in the right direction.
Kind regards.

[Rene-gad]

http://forum.kaspersky.com/index.php?showtopic=164966

[mervyne]

Please assist with removal of Worm.Win32.Mabezat.... on virtual server.
Attached is the file: avptool_sysinfo.

[Rene-gad]

Pls. make all the logs only from local session.

[mervyne]

Hi,
Please explain the term "local session" as this logfile was created on the virtual server.
Thanks.

[Rene-gad]

Hi,
Please explain the term "local session" as this logfile was created on the virtual server.

Virtual server doesn't show the correct data. You have to start AVPTool sitting direct at your Computer and logging as local administrator.