Tech guides

Whether you need removal instructions for a specific virus or just a quick tech tip - here is where you'll find advice from our team of technicians. These guides will reflect the latest security threats and hottest topics on our Antivirus Forum.


How to remove Trojan.AutoRun.A




The virus replicates through removable drives using the autorun.inf file. It activates itself when the drive containing the infected file is opened. Once executed the virus creates copies of its main executable in C:\WINDOWS\System32 with the following file names: amvo.exe, avpo.exe, amvo0.dll, amvo1.dll, avpo0.dll, avpo1.dll. The virus changes values in the registry to ensure that the infected files are loaded at every system boot and the user is unable to view hidden system files. Also, it infects each drive on computer, creating autorun.inf and files in the root folder of each drive. This way re-opening any drive will cause the infection process to repeat.



1. Make sure the infected removable disk is plugged into your computer. (USB, floppy, CD)

2. Download the archive containing the fix script for this type of infection from here

3. Save the file on your harddisk and extract it to a new folder

4. Run the fix script (kill_amvo.vbs)

5. The tool will kill the processes associated with the infection and delete the registry entries and files the virus created

6. Reboot the computer and run the fix again



Want to know more about virus removal? Visit Bullguard Security Center


The BullGuard Team

We use cookies to ensure that we give you the best experience on our website. By continuing to browse, we are assuming that you have no objection in accepting cookies. You can change your cookie settings at any time.