Tuesday, February 19, 2008

amvo.exe Virus

Been hit by a virus and it seems it has something to do with an "amvo.exe" process. It slows the machine and terribly affects the USB drives. This is how I managed to remove the virus and the amvo.exe process.

I recommend you do this in safe mode.

1. Run MSConfig (Go to Run, and type msconfig). Find a process with the name amvo.exe under the startup tab. It is located in Windows\System32 folder.
2. Uncheck the process, and then close the msconfig window.
3. Open Registry Editor (go to run, and type regedit). Search for "amvo.exe" and delete the key(s) found.
4. Now delete all amvo.exe, amvo1.dll. Note in most cases the file are hidden and system protect - use the attrib command to unhide the files and then delete them: c:\windows\system32>attrib -h -s -r amvo.exe
c:\windows\system32>del amvo.exe
c:\windows\system32>attrib -h -s -r amvo0.dll
c:\windows\system32>del amvo0.dll
c:\windows\system32>attrib -h -s -r amvo1.dll
c:\windows\system32>del amvo1.dll

Also the virus places Autorun.inf and *.cmd or *.bat (in my case d.com) files all the drives of your machine; do the following to remove them:
c:\>attrib -h -s -r autorun.inf
c:\>del autorun.inf
c:\>attrib -h -s -r d.com
c:\>del u.bat

After this the virus would have been removed, now run the latest anti-virus update and reboot your system and you are home and dry. I advise you run the www.kaspersky.com trial then when it has cleaned remove it and install your "normal" anti-virus pack.