W32.Rontokbro@mm

[fattygiant]

my notebook is now infected by this virus: W32.Rontokbro@mm ....Please help me how to deal with this?

 

[howard_hopkinso]

Make sure your antivirus programme is up to date, and has the latest virus deffinition files.

Boot into safe mode, and turn off system restore.

Do a complete scan with your antivirus, and remove anything it finds.

See HERE for further info.

Regards Howard

 

[Tedster]

removal:

http://securityresponse.symantec.com/avcenter/venc/data/w32.rontokbro@mm.html

 

[howard_hopkinso]

removal:

http://securityresponse.symantec.com/avcenter/venc/data/w32.rontokbro@mm.html

Lol Tedster. That`s the very same link as in my post.

Regards Howard

 

[fattygiant]

still not workin

i 've done it ... but ... still not working ... is there onther way??

 

[howard_hopkinso]

Go and read both these threads by RBS. Follow all the instructions exactly.

How to remove Trojans and its ilk! and How to remove Begin2search / coolwebsearch and other nasties.

Then see. How to post your Hijackthis log-file as an ATTACHMENT.

Regards Howard

 

[jon2367]

sorry to hijack your post. i've noticed signs of rontokbro on our network. symantec antivirus intercepts the load and promptly deletes them. i'm not exactly happy that the antivirus is merely doing its job. i want to find out where in the network is the infected machine so i can fix it once and for all. The manner in which it drop its load is not like the write ups on the internet.
symptoms:
- load is dropped into pcs with an active guest account without password.
- load is dropped using the guest account
- load takes the name of the directory it's dropped into eg. c:\winnt\system32\drivers\drivers.exe
- it attempts to drop its load into every single directory and subdirectory. the pc will appear to hang while its doing its rounds.

another interesting observation. after disabling the guest account, a different file in dropped into the pc - this time its qwe.bat and identified by symantec av as secefa. the secefa payload is dropped in using the system account. perhaps secefa and rontokbro mated and this is their offspring.

any idea how i can trace it to the infected machine?

rgds jon