amvo.exe....plz help me get rid of it

Viruses and worms
1

2 days back,i have connected a portable hard drive to my PC…since then i see an error pop at start-up with label “AMVO.exe” and each folder is opening up in a new window.I even cant access hidden files.Anyone please help me out with a solution.I searched many sites…but couldn’t find any solution …i am attaching the log file of Hijackthis

2

am not good with explaining but ill try…

1st you have to kill the process…
use the taskkill, run cmd.exe
example… if c is your system drive or where windows is installed

c:\taskkill /f /im amvo.exe /t

then the use attrib and del command
to unhide the amvo.exe and its libraries so you will be able to delete it…

c:\attrib -r -a -s -h autorun.inf
c:\del autorun.inf
c:\attrib -r -a -s -h c:\amvo.exe
c:\del amvo.exe
c:\attrib -r -a -s -h c:\windows\amvo.exe
c:\del c:\windows\amvo.exe
c:\attrib -r -a -s -h c:\windows\system32\amvo.exe
c:\del c:\windows\system32\amvo.exe
c:\attrib -r -a -s -h c:\windows\system32\amvo.dll
c:\del c:\windows\system32\amvo.dll
c:\attrib -r -a -s -h c:\windows\system32\amvo0.dll
c:\del c:\windows\system32\amvo0.dll

then use the registry editor to fix the show hidden file setting

3

vartismz…i tried u’r solution …but i am getting “ERROR:the process “amvo.exe” not found”

4

ok i’ve seen the hijackthis log files… use the ad-aware process watch… it will probably show there[the process or the , try to terminate the process there, after that you’ll be able to delete it hopefully… am using ad-aware too with my other installation of windows, and it really helps me alot speacially when my registry editor is disable by a virus and in terminating hidden running task invisible to windows task manager. try to make note of the path where the amvo.exe and its dlls’ you might as well modify the the sample attrib and del file i’ve posted to the correct path…

amvo.exe has another variant its pre decessor mveo.exe located in /windows/system32 icon file of the windows media player2 is used by it you may also want to terminate it and delete it as well.

^V^

5

See here for a solution:

http://forum.avast.com/index.php?topic=32637.0

6

i removed amvo from startup…but i am getting a new error at startup with heading “d.com”

7

d.com is now identified by avast. update your avast antivirus it will detect the d.com virus…
^V^

8

You can find the register entries from “regedit”

Search d.com and delete all of the enteries!!!

Also delete avmo.exe enteries.