Saturday, November 20, 2010

About AUTORUN.inf

There is a Trojan/virus (either the Win32/Pacex virus or the Win32/PSW.Agent.NDP trojan) that uses the two files ntde1ect and autorun.inf Here is how you can get rid of them:




Open Task Manager and in Processes tab end explorer.exe and wscript.exe process

Open up File –> New Task (Run) in the Task manager

Type cmd and hit Enter

Type

del /a:h /f c:\autorun.*

Go to your Windows\System32 directory by typing cd c:\windows\system32

Type dir /a:h /f avp*.*

If you see any files names avpo.dll or avpo.exe or avpo.exe, use the



Del /a:h /f avpo.exe



Open up File –> New Task (Run) in the Task manager, Type regedit

Navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

If there are any entries for avpo.exe, delete them.

Do a complete search of your registry for ntdelect.com and delete any entries you find.

To Restore Folder Options Settings, Navigate to

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\

Explorer\Advanced\Folder\Hidden\SHOWALL



Look at the “CheckedValue” key… This should be a DWORD key. If it isn’t, delete the key.Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1. The “Show hidden files & folders” check box should now work normally.