Remove Rontokbro. Description and removal instructions

Rontokbro manual removal:

Kill processes:
csrss.exe, cvt.exe, idtemplate.exe, inetinfo.exe, kangent.exe, lsass.exe, services.exe
Delete registry values:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bron-spizaetus
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions=1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD=2
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistry
Tools=1

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\”Bron-Spizaetus” = “C:\WINDOWS\PIF\CVT.exe”
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\Policies\System\”DisableRegistryTools” = “1″
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\Policies\Explorer\”NoFolderOptions” = “1″
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\Policies\System\”DisableCMD” = “2″
Delete files:
csrss.exe cvt.exe idtemplate.exe inetinfo.exe kangent.exe lsass.exe services.exe a.kotnorb.com empty.pif 3d animation.scr smss.exe bronstab.exe eksplorasi.exe Temp\\~dfa861.tmp sempalong.exe eksplorasi.exe
Delete directories:
C:\Documents and Settings\[Current User]\Local Settings\Application Data\bron.tok-24
Misc:
kangen.exe is the infected file that arrives attached to malicious e-mail messages sent by Rontokbro.

Exact file location:
cvt.exe - C:\Windows\PIF or C:\Winnt\PIF
3d animator.scr - C:\Windows\System32 or C:\Winnt\System32
a.kotnorb.com - C:\Documents and Settings\[Current User]\Templates
empty.pif - C:\Documents and Settings\[Current User]\Programs\Startup
csrss.exe, idtemplate.exe, inetinfo.exe, lsass.exe, services.exe - C:\Documents and
Settings\[Current User]\Application Data