We use cookies to ensure that we give you the best experience on our website. By continuing to browse, we are assuming that you have no objection in accepting cookies. You can change your cookie settings at any time.

Close

BullGuard Support

We’re here 24/7 to help you.


Email our support team and we'll get back to you within 24 hours.


 

How to remove Trojan.AutoRun.A

 

 

Description:

The virus replicates through removable drives using the autorun.inf file. It activates itself when the drive containing the infected file is opened. Once executed the virus creates copies of its main executable in C:\WINDOWS\System32 with the following file names: amvo.exe, avpo.exe, amvo0.dll, amvo1.dll, avpo0.dll, avpo1.dll. The virus changes values in the registry to ensure that the infected files are loaded at every system boot and the user is unable to view hidden system files. Also, it infects each drive on computer, creating autorun.inf and n1detect.com files in the root folder of each drive. This way re-opening any drive will cause the infection process to repeat.

 

REMOVAL PROCEDURE:

1. Make sure the infected removable disk is plugged into your computer. (USB, floppy, CD)

2. Download the archive containing the fix script for this type of infection from here

3. Save the file on your harddisk and extract it to a new folder

4. Run the fix script (kill_amvo.vbs)

5. The tool will kill the processes associated with the infection and delete the registry entries and files the virus created

6. Reboot the computer and run the fix again

 

 

Want to know more about virus removal? Visit Bullguard Security Center

 


Author:
The BullGuard Team



00: 00: 00: 00
Days Hours Minutes Seconds
Close