Amvo.exe, Remove Category Malware: Covert.Sys.Exec/Kavkop:Trojan-A


My computer has been infected with a worm due to transfer of some files from a USB drive. Some characteristics of it are:

- Now when i am opening any drive, its contents are opened in a new window!

- I believe its communicating on the Internet

- Its trying to set a program for startup 'IMVO.exe' stored in System32 folder depite my deleting of all registry entries related to 'Imvo.exe'

- Its also running an executable ""

-  Hidden files and protected operating system files as usual after these attacks cant be viewed.

Avast hasnt been able to remove this. Prevx CSI has detected this but is asking for payment for removal. Please guide me through the removal of this. I could have formatted the HDD and reinstalled Windows but i have very intensive s/w like VS2005 and Illustrator installed, so cant waste that much time. Thank you.

Who is Participating?
rpggamergirlConnect With a Mentor Commented:
1.  Run this tool and follow the prompts.

2.  If problem persists, also run Combofix and attach the log.
Download ComboFix to your Desktop, from either of these locations:

Double click "combofix.exe" and follow the prompts.
When finished, it shall produce a log for you.
Attach the log as a "Code Snippet" so we can check it please.
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Combofix will terminate your connection while scanning, and will resume connection when it's done.
If you have issues connecting to your network or internet after running combofix you can either simply reboot, or do the following:
* Going to Control Panel > Network Connections.
* Right click on their Network icons & select "Repair"
Alternatively, if the Network icon appears in the notification area in the lower right corner of Desktop, right-click it, and then click Repair from the shortcut menu.
Hi there...I had the same problem on a few machines so I spent a while studying the virus.

I created this set of commands and slapped them in a batch file. It works well for me.
attrib -S -H -R c:\*.*
attrib -S -H -R C:\windows\system32\amvo*.*

taskkill /F /IM amvo.exe /T
taskkill /f /fi "modules eq amvo0.dll"

del c:\autorun.inf
del c:\d6fagcs8.cmd
del c:\windows\system32\amvo.exe
del c:\windows\system32\amvo1.dll
del c:\windows\system32\amvo0.dll

REG DELETE HKLM\SOFTWARE\CLASSES\CLSID\{f26a699a-bcbb-4e37-abf9-7325da15f931} /f

this virus can also appear as fppg1.exe, and autorun.inf in your root drive or flash drive. As soon as you double click on your flash drive it will reinstall itself so you should not open "my computer". Instead go into DOS. One of the symtoms is that when you double click on the drive in my computer, instead of viewing your files you are get the "open with program" dialog. Another symtom is not being able to enable viewing hidden files. The tool RRT.exe takes care of that
do a dir /ah which will show you these files which are hidden.
Do as frostburn says above to delete the amvo files from your drive as well as from your registry also deleting  fppg1.exe and autorun.inf. Do not open my computer until you are all clean.
The following article also explains about the virus.

The reanimator.exe tool and rrt.exe are also helpful for removal.
Easiest way is ,  download and run  COMBOFIX  ;

You can get it from 

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.