My Anti Spyware

How to remove trojans that uses autorun.inf file

These trojans uses autorun.inf file for infects systems. If your computer was infected, you can to get many popups, Internet Explorer start page can to be change, new files with strange names on the your disks. (for example: selamat_berposa_dari_umt.js)

Step1: removing autorun.inf files from all your drives, include any usb/flash drives.

1. Manually:
Reboot your PC in Safe mode.

1. Restart your computer
2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3. Instead of Windows loading as normal, a menu should appear
4. Select the first option, to run Windows in Safe Mode.

Click Start -> Run
In the type box enter: del /a:h /f c:\autorun.*
Repeat this step to all drives, make replacing “c” with the appropriate drive letter.

2. Automatically.
Download Combofix.
Run, follow the prompts.
If combofix have removed autorun.inf, you have found message in the output log.
For example:

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Autorun.inf

Step 2: removing trojans autorun points in the windows registry.
Download and install HijackThis.
Run HijackThis and scan, put a checkmark next to the following items (if exists):

O4 - HKCU\..\Run: [avp] C:\WINDOWS\system32\avp.exe
O4 - HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
O4 - HKCU\..\Run: [kxva] C:\WINDOWS\system32\kxvo.exe
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O4 - HKCU\..\Run: [tava] C:\WINDOWS\system32\tavo.exe
O4 - HKCU\..\Run: [TaskMonitor] C:\WINDOWS\system32\TaskMonitor.exe
O4 - HKCU\..\Run: [Realshade] C:\WINDOWS\system32\realshade.exe
O4 - HKCU\..\Run: [cftmonn] C:\WINDOWS\system32\cftmonn.exe

Now close all browser and other windows except for HijackThis, and click “Fix Checked” to have HijackThis fix the entries you checked.

Step 3: deleting trojans files.
Download Avenger and unzip to your desktop.
Run Avenger, copy,then paste the following text in Input script Box:

Files to delete:
C:\WINDOWS\system32\avp.exe
C:\WINDOWS\system32\amvo.exe
C:\WINDOWS\system32\kxvo.exe
C:\WINDOWS\system32\kavo.exe
C:\WINDOWS\system32\tavo.exe
C:\WINDOWS\system32\SCVVHSOT.exe
C:\WINDOWS\system32\TaskMonitor.exe
C:\WINDOWS\system32\realshade.exe
C:\WINDOWS\system32\cftmonn.exe
C:\WINDOWS\system32\wincab.sys

Then click on ‘Execute’.

Your computer will be reloaded.

Step 4: disinfecting and protecting any flash drives connected to the system.
Please download Flash_Disinfector.exe by sUBs and save it to your desktop.
Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear.

The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone.

Please do so and allow the utility to clean up those drives as well. Wait until it has finished scanning and then exit the program. Reboot your computer when done.

Note1: Flash_Disinfector will create a hidden file named autorun.inf in each partition and every USB drive plugged in when you ran it. Don’t delete this folder. It will help protect your drives from future infection.

Note2: if you are still having problems with your PC, I would recommend that you follow the instructions - how to use Spyware Removal Forum.

Note3: Read more: How to disable the autorun feature to prevent malware from spreading.