Its simple.. download combofix and just click the exe.

It will clean everything all unknown virus other than this..

After testing all others instructions seen in the net..

This made it so simple in 12 mins.

Download it from here…
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

1) download ComboFix to a DIFFERENT COMPUTER if poss
2) rename it to, say, lkjhlkhjlhjk.exe, or you may prefer yteyteryt.exe (i.e. any old name)
3) copy it to the DESKTOP of the affected computer

It SHOULD work like that – I had the same trouble as others in getting it to run, the rootkit kept killing it, but this worked, though it’s very slow and looks like it’s crashed, but wait for the blue console to finish its job.

Nasty little rootkit – I bet the “author” gets a nice little jolly, perhaps even of a sexual nature, reading all this and seeing how much time we have wasted eliminating his “work”. I suppose about $200-worth, I’ll take a check, thanks. Yes, if you are reading this, you are VERY VERY CLEVER, congratulations.

For all users: after deleting, create empty files named wintems.exe hldrrr.exe srosa.sys and change permissions “DENY for All Users”, also set Read Only.
To create the blank files: (right click inside the folder, New, text document and type the names (blah.exe). make sure you can edit file extensions, otherwise the files will be wintems.exe.txt)

Make folder drivers/down or drivers/downld (was in my case) the same.

This way if there stills some stuff from the virus, you will fake the files, and they wont be accessible by the little evil.

this first part is done using linux.
if you have a dual boot machine (Ubuntu and Windows Xp), use linux.
otherwise download knoppix live cd.

here goes:

1) start you computer in linux using Ubuntu or knoppix live CD.
2) mount your ntfs file system using something like:
mount /dev/sdaX /media (x is your ntfs partition)
and delete wintems.exe from c:\windows\system32\wintems.exe (mine was in /media/sda1)
also delete:
rm -f /media/WINDOWNS/system32/drivers/hldrrr.exe
and rm -f /media/WINDOWNS/system32/drivers/srosa.sys.
(it might be slightly different path or case-sensitive)
3. Then I delete the directory c:\windows\system\drivers\down or downld

4. reboot and start Windowx XP
5. I delete the registry key:

# Run regedit go to:

HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache

and see all entries regarding “C:\WINDOWS\system32\drivers” .
# In Explorer window Go to> tools>folder options>view and select show hidden files
# Browse to your C:\WINDOWS\system32\drivers ..
find drivers folder and try to delete all files listed in:

HKEY_CURRENT_USER\Software\Microsoft\Windows\ShellNoRoam\MUICache

7. install Avast or AVG and make a full scan without problem

good luck!

Eran

The virus rebooted the PC, then infected a couple of service programs to load with Windows.

The thing that worked, was Combofix, when renamed on downloading. Then everything (almost) got cured by Gmer and manually in Regedit – all the keys related to the filenames of the virus files. Then I used Panda to clear the traces.

It won’t show after reboot, but I am not sure as to what it has done and what information destructed or stole. Are there any ideas on that point?