How to remove Trojan.AutoRun.A
Description:
The virus replicates through removable drives using the autorun.inf file. It activates itself when the drive containing the infected file is opened. Once executed the virus creates copies of its main executable in C:\WINDOWS\System32 with the following file names: amvo.exe, avpo.exe, amvo0.dll, amvo1.dll, avpo0.dll, avpo1.dll. The virus changes values in the registry to ensure that the infected files are loaded at every system boot and the user is unable to view hidden system files. Also, it infects each drive on computer, creating autorun.inf and n1detect.com files in the root folder of each drive. This way re-opening any drive will cause the infection process to repeat.
REMOVAL PROCEDURE:
1. Make sure the infected removable disk is plugged into your computer. (USB, floppy, CD)
2. Download the archive containing the fix script for this type of infection from here
3. Save the file on your harddisk and extract it to a new folder
4. Run the fix script (kill_amvo.vbs)
5. The tool will kill the processes associated with the infection and delete the registry entries and files the virus created
6. Reboot the computer and run the fix again
Want to know more about virus removal? Visit Bullguard Security Center
Author:
The BullGuard Team