How to DELETE RavMonE.exe, AUTORUN.INF, msvcr71.dll
I am using Windows XP.
Lets name (RavMonE.exe,AUTORUN.INF,msvcr71.dll) as TRIO.
After plugging in your USB device, DO NOT do anything
even if Windows asks what to do to open the drive.
CANCEL or CLOSE it. DO NOT double-click your USB drive/device.
If you want to know if your USB drive contains TRIO, right-click
it within My Computer. If you see “Auto” written in bold above “AutoPlay”
then it means you have the TRIO virus/worm (i dont know but it stinks).
The reason for NOT double-clicking it is that AUTORUN.INF will execute
some instructions… messing your registry…
Even if you show all files within the Folder Options, TRIO will
not show up on your USB device. The only chance to see it is
using the command window.
These are the steps on how to delete it assuming you follow those
instructions mentioned earlier:
important: Press Ctrl+Alt+Delete then
Go to the Process tab, select Image Name: RavMonE.exe, click “End Process”
and confirm it “Yes”.
-
Go to Start menu then Run. Type: cmd or command
-
Type your USB drive letter: e.g. G:
-
Type on the command window: edit AUTORUN.INF (edit or dont edit the file.)
-
“Save As” the file with the SAME NAME AND DIRECTORY replacing the original
file. This will prevent the file from being invisible. -
Exit the ms-dos editor
-
Do the same for RavMonE.exe and msvcr71.dll (steps 3-5)
-
On the command window, delete the files
e.g: del AUTORUN.INF
del RavMonE.exe
del msvcr71.dll -
Exit the command window by closing it or typing: exit
-
This is a very necessary step: RESTART YOUR PC
Your USB drive is now virus free / worm free. You can now double-click it
inside My Computer.
===============================================================================
In case you accidentally double-clicked your USB drive. The following steps
on how to delete it are the following:
a. Press Ctrl+Alt+Delete
b. Go to the Process tab, select Image Name: RavMonE.exe, click “End Process”
and confirm it “Yes”.
c. Do the instructions above from 1-9
d. Go to Start menu then Run. Type: cmd or command
e. Type on the command window: cd
f. Type: cd Windows
g. Try typing “RavM” and strike Tab on your keyboard in order to see if RavMonE.exe
is residing inside Windows folder. Do the same for AUTORUN.INF and
msvcr71.dll. If one or all of them is present then type: cls
h. Do steps 3-5
i. Go to c:\windowd\system32 folder. In case you have already opened the command
window, type: cd system32 and DO steps 3-5 again
j. DO steps 8 and 9.
I know RavMonE.exe is present inside the registry after you accidentally
double-clicked your USB drive but accessing and modifying the windows registry
is a risk. Please don’t try.
For advance users, search for RavMonE.exe only inside the registry
and modify its entry. You can delete its entry but it’s not applicable
if RavMonE.exe is included with the system files entry. Only erase the word/s
“RavMonE.exe e”.
xmx23 is always open for suggestions/corrections.