Link to home
Start Free TrialLog in
Avatar of theNab
theNab

asked on

Amvo.exe, Nideiect.com Remove Category Malware: Covert.Sys.Exec/Kavkop:Trojan-A

Hi

My computer has been infected with a worm due to transfer of some files from a USB drive. Some characteristics of it are:

- Now when i am opening any drive, its contents are opened in a new window!

- I believe its communicating on the Internet

- Its trying to set a program for startup 'IMVO.exe' stored in System32 folder depite my deleting of all registry entries related to 'Imvo.exe'

- Its also running an executable "Nideiect.com"

-  Hidden files and protected operating system files as usual after these attacks cant be viewed.

Avast hasnt been able to remove this. Prevx CSI has detected this but is asking for payment for removal. Please guide me through the removal of this. I could have formatted the HDD and reinstalled Windows but i have very intensive s/w like VS2005 and Illustrator installed, so cant waste that much time. Thank you.

ASKER CERTIFIED SOLUTION
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Hi there...I had the same problem on a few machines so I spent a while studying the virus.

I created this set of commands and slapped them in a batch file. It works well for me.
**************************************************************************************************************************
attrib -S -H -R c:\*.*
attrib -S -H -R C:\windows\system32\amvo*.*

taskkill /F /IM amvo.exe /T
taskkill /f /fi "modules eq amvo0.dll"

del c:\autorun.inf
del c:\d6fagcs8.cmd
del c:\windows\system32\amvo.exe
del c:\windows\system32\amvo1.dll
del c:\windows\system32\amvo0.dll

REG DELETE HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /v amva /f
REG DELETE HKLM\SOFTWARE\CLASSES\CLSID\{f26a699a-bcbb-4e37-abf9-7325da15f931} /f
REG ADD HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED\FOLDER\HIDDEN\SHOWALL /V Checkedvalue /t REG_DWORD /d 1 /f
REG ADD HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\ADVANCED /v Hidden /t REG_DWORD /d 1 /f
PAUSE

***********************************************************************************************
Regards
FB
Avatar of kellykln
kellykln

this virus can also appear as fppg1.exe, and autorun.inf in your root drive or flash drive. As soon as you double click on your flash drive it will reinstall itself so you should not open "my computer". Instead go into DOS. One of the symtoms is that when you double click on the drive in my computer, instead of viewing your files you are get the "open with program" dialog. Another symtom is not being able to enable viewing hidden files. The tool RRT.exe takes care of that
do a dir /ah which will show you these files which are hidden.
Do as frostburn says above to delete the amvo files from your drive as well as from your registry also deleting  fppg1.exe and autorun.inf. Do not open my computer until you are all clean.
The following article also explains about the virus.

The reanimator.exe tool and rrt.exe are also helpful for removal.
http://rahulhackingarticles.wetpaint.com/thread/1155520/hidden+files+problem+and+%22amvo.exe+trojan%22/post/8673184/hidden+files+problem+and+%22amvo.exe+trojan%22?t=anon
Easiest way is ,  download and run  COMBOFIX  ;

You can get it from http://download.bleepingcomputer.com/sUBs/ComboFix.exe