Manually remove mpstxgx.exe or rttrwq.exe trojan

Kaspersky V6.0 reported there is a trojan named mpstxgx.exe on my PC, and Kaspersky tried to deleted the mpstxgx.exe file, but it was created again and again in the C:\ and D:\. I have to remove this Trojan manualy.

After did some research, I knew these files are related to this Trojan: mpstxgx.exe, rttrwq.exe, and mkfght0.dll. To remove mpxstxgx.exe, I first restart the Windows XP to Safe mode with Command Prompt, then from type the commands below:

c:\>attrib -r -s -h autorun.inf
c:\>del autorun.inf
c:\>attrib -r -s -h mpstxgx.exe
c:\>del mpstxgx.exe
c:\>attrib -r -s -h \windows\system32\rttrwq.exe
c:\>del \windows\system32\rttrwq.exe
c:\>attrib -r -s -h \windows\system32\mkfght0.dll
c:\>del \windows\system32\mkfght0.dll
c:\>D:
D:\>attrib -r -s -h autorun.inf
D:\>del autorun.inf
D:\>attrib -r -s -h mpstxgx.exe
D:\>del mpstxgx.exe


After that, restart my PC to Windows XP normal mode. run regedit from CMD. and change the CheckedValue value in this location from 0 to 1:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\
Advanced\ Folder\Hidden\SHOWALL\

That's done.