Cleaned amvo.exe virus manually
11 June 2009Today I got one virus in my system. When I try to login to the Yahoo messenger, it is closing without logging in. I have found a virus (don't know name) and cleaned it manually. I have taken the below steps to remove this virus manually.
- First I have checked in task manager, I didn't find any suspicious processes.
- Next I opened MSConfig (Go to run, and type msconfig). I have found one process with the name amvo.exe under the startup tab. It is located in Windows\System32 folder.
- I unchecked the process, and closed the msconfig window.
- Next I open Registry Editor (go to run, and type regedit). I have searched for "amvo.exe" and found one entry. I have deleted the whole key.
- Next I have tried to set the option to "show hidden files" (Go to Tools> View in windows explorer), as virus file is hidden. But it is not allowing me. As soon as I set it to show hidden files and clicked on ok, it is changing back to "Don't show hidden files".
- Then I have used Bullet Proof FTP software to browse the local disk, because it shows all files even hidden files. (I have already installed FTP software in my system. You can get free trial version from the website.)
- Then I have browsed to Windows\System32 folder, and deleted amvo.exe, amvo0.dll, amvo1.dll.
- This virus put an Autorun.inf file, and .cmd file in every drive's root. I have removed all those.
Don't forget to disable system restore before starting the cleaning process, and open windows in safe mode.
Update: I built two files to clean this virus automatically. After downloading the AMVO Cleaner, unzip the file to get a folder. Open that folder, and double click on the file named AMVO_Delete. It should have cleaned the virus. Please let me know whether your problem solved in the comments section below.
Disable Messenger Service
- Open Services window (Win+R and type services.msc or you can go to control panel, Performance and Maintenance, Administrative Tools, Services).
- Select Messenger service, right click and select properties. Change startup type to Disabled.
- Thats it. You won't get any popups from Internet.
Registry Accessing disabled?
Many viruses disable the access to the registry so that we can't remove the virus entries in the registry. In these cases you can download the following file UnHookExec.inf. After downloaded, right click on the file, and select Install.
You can enable it manually by editing the group policy editor. Go to Windows > Run > gpEdit.msc
Go to User Configuration > Administrative Templates > System > Prevent Access to Registry Editing Tools. Disable it. You should be able to open regedit now.
Source: Tool to reset shell\open\command registry keys
Removed Fun.exe, dc.exe, SVIQ.exe virus
I have got a virus, which automatically opening the Yahoo messenger. So, when I have looked the processes in the task manager, I have found the following processes Fun.exe, dc.exe, SVIQ.exe.
I killed those processes, by right clicking the process and select "End Process Tree". After I have killed all those processes, I searched Internet and found the following link W32.Imaut.AS (also called Dung Coi). Then I have deleted all the virus files and cleaned the registry.
I am describing the exact steps below:
- First go to the task manager (right click on the task bar > task manager) and select the processes tab.
- Right click on the Fun.exe, dc.exe, SVIQ.exe and select "End Process Tree". This stops the viruses from interrupting in the cleanup process.
- Go to the MSConfig (Win+R, type MSConfig and press enter). Go to the startup tab. Uncheck the dc.exe, fun.exe, SVIQ.exe, Other.exe, Win.exe. This stop the virus processes from starting with the windows.
- Next go to the Registry Editor (Win+R, type RegEdit and press enter). Remove the following keys
- dc, dc2k5, fun under the key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
- load, run under the key HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows
- Go to the key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon and Modify Shell's value to "Explorer.exe".
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\dc
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\dc2k5
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Fun
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Load
- Remove HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Run
- Delete the following files.
- %Windir%\Help\Other.exe
- %Windir%\inf\Other.exe
- %Windir%\system\Fun.exe
- %Windir%\System32\config\Win.exe
- %Windir%\System32\WinSit.exe
- %Windir%\dc.exe
- %Windir%\SVIQ.exe
- %Windir%\System32\NWB.dat
- c:\PNga.txt
- %Windir%\wininit.ini
Thats it. I got rid from the virus. I read in the net that this virus will create a copy of virus file in directories with the same name and uses a folder icon, so that users will click on it thinking it was a folder. But, I dint get any files like that, if you got any files like that, don't click on them, delete them immediately. If you have any doubt, right click on that and select properties, then you can know whether it is a file or folder.
