Windows 7 Forums

Welcome to Windows 7 Forums. Our forum is dedicated to helping you find support and solutions for any problems regarding your Windows 7 PC be it Dell, HP, Acer, Asus or a custom build. We also provide an extensive Windows 7 tutorial section that covers a wide range of tips and tricks.

Windows 7: Cant remove Autorun Worm

10 Dec 2009   #11

Windows® 8 Pro (64-bit)

Quote   Quote: Originally Posted by Orpheous View Post
Quote   Quote: Originally Posted by Dinesh View Post
Hi there, I did a clean install and fixed all issues.
Did you re-install because you had a windows worm?
I keep playing with viruses and anti-virus programs. So I end up reinstalling my OS every month or two...

My System SpecsSystem Spec
10 Dec 2009   #12
The Apathetic

Windows 7 Ultimate x64

Next time use > Smart Virus Remover <, just run it then plug in the Flash drive and viola, it's gone..

Edit: you install windows every month or 2? dude, my windows xp lasted once for 11 months (from June 2008 to May 2009) but then it was infected with a stupid virus which was hiding my hidden files permanently and whenever I open a folder it opens in a new folder, that stuff was really annoying so I had to format cause not a single AV (Kaspersky, Norton, Bitdefender, Nod, Avast) was able to remove it, but even after formatting it came back and then I found that miracle worker AV called "Smart Virus Remover" and as soon as I ran it, the virus was removed and I lived happily ever after..

Note that "Smart Virus Remover" only removes certain viruses, it doesn't offer full protection, just use it when you have a stupid virus that no other AV can remove.
My System SpecsSystem Spec
10 Feb 2010   #13

Windows 7 Ultimate x64

[QUOTE=I keep playing with viruses and anti-virus programs.[/QUOTE]
Go to to see if your antivirus works properly.
These are test files, they do NOT contain any malicious code at all, it is just merely text.

[QUOTE=Next time use > Smart Virus Remover <[/QUOTE]
You can use TrojanGuarder Golden, which guards you from almost all trojans and keyloggers, it's free (also legally free) and to use without limit. Ive made a portable version which you can download here:

The Virus you had is a keylogger, similar to the Avpo variant. Avpo logs the keys from online games like World of Warcraft, Warhammer, Lord of the Rings online, Aion, etc.


It abuses system names, like ntdetect, it makes a system file called for example ntde1ect (note the ntde1ect) which looks the same but contains the information of the keylogger. Ntdetect is a needed system file (without it your system cannot boot!) whereas Ntde1ect is the virus. It also creates amvo.exe files and avp1 or other random generated names (1cdazz.cmd, etc.) at your system32 folder in windows and at every root location of any drive which you got connected (removable devices like usb sticks also get infected!)

To get rid of it, simply do the following;

Go start, press run and type in; msconfig
Go to the tab startup and search for any stupid names, like for example (things that dont make any sense). If you are not sure you can always google on it (type in the name of the program on google). Once you have disabled the startup of the virus, you will still need to get rid of the files, the most handiest thing to do is use an antivirus to scan (I found Eset had the most chance to find this virus, together with Avira). However, it can be that the files are hiding themselves by making them systemfiles. Therefor, it is a good idea to make them visible.

Go to start, press run and type cmd
type: C:
type cd\
you should see C:
type attrib -r -s -h *.*
type D:
type attrib -r -s -h *.*

continue typing the driveletters and typing attrib for all of the drives you have connected, (note that cd/dvd drives cannot be infected so you do not have to clean them!).

Also, after having attribbed all drives, do not open any of your drives by double clicking on them, as the virus will start respreading itself again (due to the fact that there is a autorun.inf file on it). Let your antivirus do a full system scan and the virus should be removed.

If you really need to access any of your drives, then you can do that, by doing so the following way (which will NOT trigger the virus to reproduce!).

Click on my computer
In the address bar, type the driveletter of your drive (for example C: ) and press enter
You then see your drive which you want to access and if you see autorun.inf you can also manually delete it.

NOTE; if autorun.inf has been deleted on one of your drives you may not be able to access it via the usual way untill you reboot your computer, the best way to access your drive untill the system scan is complete is by doing it the way as descrebibed above.

I hope this helps people in the future who come across this problem. I had this problem and had a hard time to figure all this out by myself and get rid of this problem (but I know alot about it now). If you need help with THIS problem and this post does not provide you all the necessary information, you can reply to this post or send me a PM . Goodluck.
My System SpecsSystem Spec


 Cant remove Autorun Worm

Thread Tools Search this Thread
Search this Thread:

Advanced Search

Similar help and support threads
Thread Forum
USB autorun
when my USB is plunged or is opened in the file explorer i want a bat file run how would i do this
General Discussion
How to Autorun USB on Win 7
Hi, I want to make a USB flash drive auto run a website link in Windows 7. I know the auto run function has been removed in Win 7, but can I at least make a pop up window appear whenever a USB flash drive is inserted in the PC and have the user the option to click and open the link??? ...
USB autorun in W7
Ok, I know this is a sore subject, but are there any work-a-rounds to get handy programs like PortableApps to at least be an option to run when you plug it in? It kind of defeats the purpose of the whole thing. I'm not plugging in rogue USB sticks from strangers in dark alleys, just my own USB...
General Discussion
Is missing or corrupted.. anyone have this prob..? I have dl'd and burned the iso 2x and have the same prob. let me say that in order to burn iso..i have just renamed the longnamed file to (the longname).iso i have been dl'ing it with ff and it is adding a ,dlm to the file and i have just been...
Installation & Setup
Worm vb-740
I use ClamWin AV (latest, up-to-date version) Windows 7 (Build 7100) Anyone else find one of these in a virus scan? It wasn't there until after i did a Windows Update! Scan Started Mon Jun 01 13:26:54 2009 ---------------------------------------
System Security

Our Sites

Site Links

About Us

Find Us

Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.

© Designer Media Ltd

All times are GMT -5. The time now is 13:35.

Twitter Facebook Google+

Windows 7 Forums

Seven Forums Android App Seven Forums IOS App