Virus files include: 608769m.bmp crasos.exe Kernelmh.exe servet.exe ntmsoprq.exe RpcS.exe compmgmt.exe Upxdnd.dll Cmdbcs.dll wsttrs.exe prnmngr.exe iexpl0re.exe rundl132.exe update3.exe Servere.exe newinfo.rxk
This also does not know what virus, is in browsing a webpage when recruit, as long as poisoned will be in your hard disk to generate a heap of virus files, distributed in multiple system disk folder.
According to my observation, the harm of this virus is to automatically download other virus files on the Internet, boot automatically after starting Cmd.exe, this program is crazy for memory and CPU, the machine is very slow, Task Manager can find the above those broken files, there are two iexplore.exe run.
Antivirus principle: Into Safe mode, in the service to find loading Wsttrs.exe This program's service name, disabled.
Hard drive search above those file names, all deleted, enter the registry search above related names, the deletion!
That's how I handled it. Recommend the following related technical documents for reference.
——————————————————————————————————————————————
First, clear IE temporary files: Open IE point tool->internet option->internet temporary file-> point "delete Files" button-> will "delete all offline content" tick-> point "OK".
Delete the following registry key with SRE:
<cmdbcs><C:\WINDOWS\cmdbcs.exe>
<upxdnd><C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\update3.exe>
<mppds><C:\WINDOWS\mppds.exe>
<twin><C:\WINDOWS\system32\twunk32.exe>
<><c:\program Files\Common Files\Microsoft Shared\msinfo\newinfo.rxk>
<compmgmt><; C:\windows\system32\compmgmt.exe>
<iz46z07lw><; C:\docume~1\admini~1\locals~1\temp\crasos.exe>
<kernelmh><; C:\windows\kernelmh.exe>
<ntmsoprq><; C:\windows\system32\ntmsoprq.exe>
<qt3ii85kvbfc><; C:\docume~1\admini~1\locals~1\temp\servere.exe>
<scrnsave><; C:\windows\system32\prnmngr.exe>
<upxdnd><; C:\docume~1\admini~1\locals~1\temp\update3.exe>
<viq88><; C:\docume~1\admini~1\locals~1\temp\rundl132.exe>
<wsttrs><; C:\windows\wsttrs.exe>
<yi4jgw1ff><; C:\docume~1\admini~1\locals~1\temp\iexpl0re.exe>
Repair the following registry key with SRE:
<AppInit_DLLs><608769M.BMP>
Remove the following service items with SRE:
Remote Procedure Call System (RPCs)/RPCs
Windows Systemdown/windowsdown
Delete the following files with Unlocker:
C:\WINDOWS\system32\mppds.dll
C:\docume~1\admini~1\locals~1\temp\upxdnd.dll
C:\WINDOWS\system32\cmdbcs.dll
C:\WINDOWS\system32\compmgmt.exe
C:\docume~1\admini~1\locals~1\temp\crasos.exe
C:\WINDOWS\608769M. Bmp
C:\WINDOWS\system32\servet.exe
C:\WINDOWS\wsttrs.exe
C:\WINDOWS\system32\ntmsoprq.exe
C:\WINDOWS\Kernelmh.exe
C:\WINDOWS\system32\RpcS.exe
C:\WINDOWS\system32\prnmngr.exe
C:\WINDOWS\mppds.exe
C:\docume~1\admini~1\locals~1\temp\servere.exe
C:\docume~1\admini~1\locals~1\temp\update3.exe
C:\docume~1\admini~1\locals~1\temp\rundl132.exe
C:\docume~1\admini~1\locals~1\temp\iexpl0re.exe
C:\Program Files\Common Files\Microsoft Shared\msinfo\newinfo.rxk
Finally reboot the computer. The virus was taken care of!
