How to remove Win32/NSAnti, d.com virus without any anti-virus tool

by Rohit Khurana on January 16, 2008

Advertisement

Trouble:

Recently we received a mail from one of our readers whose computer was infected by Win32/NSAnti virus, this virus mainly causes drive opening problem by double click in windows XP.

If your system is infected by this virus you can’t see hidden files and folders , even after applying the settings to show hidden folders. This setting is reverted back to Don’t show hidden files and folders by the virus.

This happens because virus protects the two hidden ,system files called d.com and autorun,inf which are created by amvo.exe and amvo0.dll , amvo1.dll which resides in system32 folder on the OS drive (hard disk partition on which windows operating system is installed).

Fix:

In order to fix the problems caused by this virus ,you will need to delete all these files created by the virus.

Follow the set of commands to delete these files


1. Open Start>>Run and type cmd and press enter. This will open windows command prompt window. On this window, type as directed in steps further and press enter at the end of each step.

2. type cd\

3. type cd windows\system32

4. type attrib -r -h -s amvo.exe

5. type del amvo.exe

6. type attrib -r -h -s avmo0.dll ,repeat the steps 5 and 6 again to delete avmo1.dll

7. now type d: and press enter for d: drive partition.

8. type attrib -r -h -s autorun.inf

9. type del autorun.inf

10. type attrib -r -h -s d.com

11. type del d.com

Similarly repeat from steps 8 to 11 for all your hard disk partitions to remove the files created by the virus.

Note: Above procedure may seems cumbersome but proves to be of great help to repair your system, if none of your anti-virus tools is able to solve the problem and remove the infections caused by the virus.

Updated (21 Jan 2008):

Advertisement

We have just received some comments by the users who do not find above method useful as they were not able to remove amvo.exe virus by following the above method.

For all those who are facing issues with the above method, can follow the steps given below to remove the virus.

1. First download Trend Micro HijackThis from here

2. Install and run the scan ,you will see an entry like this :

HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe

3. Check the above entry and click on the button which says Fix Checked and click yes on the prompt.

4. Uncheck amvo.exe from msconfig>> startup (type msconfig in run and click on the startup tab) also and restart your system

5. Open my computer and go to folder options >> check the option show hidden files and folders. Also un-check the option Hide protected operating system files (This will give a warning message, confirm by pressing yes button). After this click Ok.

6. Now access all your system drives by typing the drive letters in the address bar (for example c:) and delete the files like autorun.inf and other file with a name ms18us.exe (sorry but I am not sure about the second file name )

7. Also delete the files amvo.dll and amvo1.dll from windows/system32 folder.

Updated ( 28 Jan 2008)

Note: Looks like that for most of the people both of the above methods are little bit confusing in terms of implementation.

So we would like tell another method to remove amvo and ampo virus by using a vbscript which you can download from http://www.en.mygeekside.com/?p=18 by clicking here. You can easily remove the virus by double clicking the script.

PS: But we dont take any responsibility if this script causes any damage to your system so use it on your own risk.

We hope the new solution for removal of win32/ns anti virus will help.

Also See : Virus Removal Tips By Trouble Fixers

If you like this article or this article helped you, you can +1 to recommend this article on google plus.

You can follow us on Twitter or join our Facebook Fan Page. If you have a question to ask us, submit your question at Answers By Trouble Fixers.

Looking for something else? Search here :

{ 75 comments… read them below or add one }

Stanley January 18, 2008 at 2:27 pm

I hope that I can erase that virus… thanks for the info…

Deviyananda gupta January 20, 2008 at 8:56 pm

Dear Sir,
I have been followed your step, but still i could not able to delete amvo0.dll (it says unable to find the file in that specific folder) and i could not able to find the amvo1.dll

Pls give suggestion for this problem.

Regards
Gupta

arshj January 21, 2008 at 12:38 am

well it doesn’t work so easily as is displayed.

Jade January 21, 2008 at 12:44 am

You should look inside autoexec.inf to check the name of the other file is loaded in order to remove it as well as in the registry entries

And also check all the usb drives, as the virus uses them to spread itself. Dont open the usb drive, just explore it, to avoid autorun.inf to execute it again (maybe pressing shif while you insert the usb may help)

Arjun January 21, 2008 at 4:18 am

Hi
Im getting access denied for amvo0.dll file man
then what to do..?
Please help me man outoff this..

casey January 21, 2008 at 10:18 am

hey i did the second tip but HIJACK THIS couldnt find HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe…in my computer..can u plz help…..

Nekhrun January 23, 2008 at 8:04 am

found the solution, a combination of first and second works. :)

First, these files are not visible in windows explorer. Open command prompt, jump to the drive and run command dir /ah to view the hidden files. eg:

cd d:
dir /ah

you may see files like:
autorun.inf
d.com
and some other files

now do the following:

1. run Hijackthis tool and fix the amvo.exe file as suggested in second method (step 1-4).

2. In Start -> Run, enter “msconfig.sys”, and unchek the amvo.exe file from the startup list. It might be present there and restart pc.

2. after restart, DO NOT open/double click on any drive. Run the hijackthis tool again to ensure the amvo.exe file is not in the list. Now, execute the foll commands in command propmt:

cd c:\windows\system32
attrib -r -h -s amvo.exe
del amvo.exe
attrib -r -h -s avmo0.dll
del amvo0.dll
attrib -r -h -s avmo1.dll
del amvo1.dll

now, jump to each drive and run these commands:

attrib -r -h -s autorun.inf
del autorun.inf
attrib -r -h -s d.com
del d.com

for each extra hidden file, run the above commands with filename replaced.

When all the files are deleted, restart the machine, and again check with hijackthis tool.

Good luck.

KK January 23, 2008 at 9:35 pm

Hi,
I have removes all the autorun.inf files from my system, I did not find any amvo.exe or such dlls. it says file not found. I have solved problem of drive opening but still I am not able see hidden file. when i try to folder options >> check the option show hidden files and folders. Also un-check the option Hide protected operating system files (This will give a warning message, confirm by pressing yes button). After this click Ok, still I got the problem to see hidden files….
Pls give suggestion for this problem.

Regards,
KK

nekhrun January 23, 2008 at 11:17 pm

@KK

Did you try the DOS way??
Open command prompt, jump to the drive and run command dir /ah to view the hidden files. eg:

cd d:
dir /ah

let me know if you still can’t see the files.

Frame January 24, 2008 at 2:34 pm

Hey guys,

I removed all the files indicated above. But I am still unable to enable “show hidden files”. And also, there is someting wrong with the system, I can’t install a program, there is always an error message.

Does anyone how to find the folder options congiguraiton file (*.ini or something). Maybe that could help me to enable the hidden files.

Thanks.

mohit January 26, 2008 at 6:05 am

thanks so much nekhrun, ya it really works……..hey guys,try as nekhrun has said…

Neero January 27, 2008 at 8:23 am

Man, Nekhrun’s method is right for only the autorun problem. But nothing happend with the HIDDEN FILE prblem. In the dos mode the hidden files are available, but in explorer the same problem. What to do with that. But obeously a big thanks to Nekhrun to atlest 1 solution. Cheers

Nekhrun January 29, 2008 at 7:57 am

@Neero

yes you are right. i have deleted all the virus files, but i am still having the hidden file/folder problem and still looking for the solution. let me know if you find any solution.

Chris January 29, 2008 at 9:06 am

1. Go to your Start menu, click on Run and open up your Registry Editor by typing: regedit
2. Once there go to: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folde r\Hidden\SHOWALL
3. Double click the value called CheckedValue, and modify its data value (DWORD Value) to 1 (0x00000001)

Let me know if it works :)

Chris January 29, 2008 at 10:39 am

Almost forgot….step 4

4. Go back to folder options (Tools>>>FOlder options>>>Click View Tab>>>Click Show Hidden files and folders>>>and OK)

And you win then have your HIdden files back! 😉

Nekhrun January 31, 2008 at 6:47 am

@Chris

Yes it works :)

thanx a lot dude.

Narayan Chhetry January 31, 2008 at 11:11 pm

Hey,Its gr8 man.It is working.Thanks a lot.

Naser February 3, 2008 at 7:00 am

O’ my good gracious lord o’ mighty, I can’t believe that the VB-script actually worked :’) I was so pissed off at all these solutions posted online, none of which actually did their purpose. A gazillion thanks for posting such a lifesaver man :)

another_way February 3, 2008 at 12:25 pm

There is another way if it’s too difficult for you, use this patch, download the file, extract and start, just click “patcher” and that’s all.

http://www.net-studio.org/application/autorun-av.php

Bhasker February 6, 2008 at 10:30 am

thanku for u r help and solution

Rohan Kelkar February 6, 2008 at 6:44 pm

Thanks for that
i did as you said
but files avmo0.dll and avmo1.dll not found
also file d.com not found
now i persist problem with opening the partitions
when i double click the partition it says choose the program you want to use to open this file.
How do i fix this?

another_way February 7, 2008 at 6:31 am

The file autorun.inf is still in your partition,

Download the patch http://www.net-studio.org/application/autorun-av.php
Put it in your desktop
Restart your pc in safe mode
Unrar the patch and open it
Click Patcher

—————
Another way :
Restart in safe mode
Go to start button
Select Run and enter cmd then OK
You are now in command prompt

tape and validate for each line

c:
cd\
attrib -s -h -r autorun.inf
del autorun.inf

do it for each partition you have
ex for d:

d:
cd\
attrib -s -h -r autorun.inf
del autorun.inf

etc…

Restart you pc

makhmal Khan February 7, 2008 at 9:53 am

GREAT, GREAT, GREAT
Guys, you are life savers
THANKS, THANKS, THANKS
so many thanks for your invaluable comments
I solved this boring problem, just with your help.
I am GRATEFUL! :))

Chris February 9, 2008 at 3:15 am

Hi Guyz, Ive been dosed with another problem. My cmd.exe, regedit.exe, computer management and other important “.exe” extentions/programs dont work. When I try to execute them i get the ffw message “This operation has been cancelled due to restriction in effect on this computer.Please contact your system administrator.” Does anyone have a solution for me PLEASE!!!!!!!!!!!!!!!!!

Farid February 9, 2008 at 6:05 pm

Thank u for u r tips to remove virus from my pc. Keep a good work .
I am very very greatful.
Thank u so muchhhh .

Lawrence February 10, 2008 at 2:09 am

Thanks rohit and neckrhun for the solutions it seems that i finally erased it from my usb devices and hard drives…. luckily i have a system restore point just before i got the virus! thanks guyz

Prabhat Kumar Jha February 10, 2008 at 10:10 pm

Thanks, i have solved my hidden file problem and now i am able to hide and retrive the files.

Prabhat Kumar Jha February 12, 2008 at 9:04 pm

Dear sir,
I have solved the problem however once again i have to face the same problem. Through CMD command it shows that no such file is exit. When installing kill_amvo_virus_usb_en.vbs At the first time it is sucess and from the second time i have to face the same problem.
Please reply me.

parveen Mittal February 13, 2008 at 3:27 am

hi All

i was facing the same issue.

the dos way was not working :(

i tried the script , it really worked for me .

thanks

kavi February 13, 2008 at 10:31 pm

Hallo, Experts.
my pc was infected by AMVO.EXE and was harrasing a lot, on Google i search solutions, i got also and i gone through it’s instruction also to remove this worm, but it was not effecting, the file was generating again and again,
but when i found trouble fixers,and specially the VB Script given in website of Trouble Fixers, as soon as i run it the Worm Amvo.exe become disappear,
you people are really Experts and should all must be given award. Please do continue help the pople like us who are not much aware with deep of computers, just we are operating.
and one more thing, you experts are required to use very very lucid language, so layman like us can understand, i:e: here in your website you’v mention TYPE ATTRIB -R -H -S, this line is not highlited when others all line which we have to type is highlited, so we may confuse that what is ATTRIB and who to write this -R-H-S..? etc. so my huble request to make it very easy, lucid and understable.
thank u very much.

kavi
(india)

Rohit February 13, 2008 at 10:47 pm

@Kavi

Thnaks for your appreciation and suggestions. I have corrected the same. :-)

Saurabh Sarin February 18, 2008 at 7:23 am

Thank you so much for providing the solution to this unique virus. i had lost the hope of recovering my OS n thought only option which is left is to reinstall but u saved my time n effort.

Actually, first of all i tried ur VB script methood (bcoz that seemed to be the most simple one), but still it was d same, then i tried the 1st method, still d same, in the end i tried the 2nd method still it was d same. finally i restarted then applied this step 5 of 2nd option again [Open my computer and go to folder options >> check the option show hidden files and folders. Also un-check the option Hide protected operating system files (This will give a warning message, confirm by pressing yes button). After this click Ok.]
and then deleted the files amvo.dll and amvo1.dll from
D:windows/system32 folder.last

Atlast i got my healthy OS again.

i am so grateful to u, my gratitute is endless. . .

Stella February 19, 2008 at 1:14 pm

thanks a lot!! I’m very happy to have found this website to fix this virus. The first 2 methods didn’t work for me but the script did the job!! I was about to do a format and clean install of my OS when I found this website to get rid of the virus. Thanks!

Tope February 20, 2008 at 11:55 am

I spent the whole day tying to fix this virus and eventually did it manually thanks to the clues i got from this site as well as some others. Its not that the manual method doesn’t work but that the names of the files created by the virus may differ. For example, the .exe file on mine was kavo.exe, not amvo.exe and the .com file was h2.com, not d.com or ntdelect.com. Of course, if you’re not too “good” at computers, removing it manually may prove difficult or impossible so its a great thing the scripts and patches exist. This was the worst virus that infected my system yet and several antivirus programs don’t even detect it.
You guys are doing a great job!

sunil February 24, 2008 at 11:39 pm

hi
this is sunil from Hyderabad,india

With VB script(Third option from above) i was able to solve my problem successfully and my OS was again running smooth and reiable.

thanks so much for the solution

bye
sunil
india

manas February 25, 2008 at 7:26 am

thnkq but i cant find amvo.dll in sys32

abhi February 25, 2008 at 2:38 pm

hi guys,
nekhruns stuff really worked. now im able to see all the hidden files. try nekhruns stuff.

hukares February 26, 2008 at 7:52 pm

@Tope:
it is pretty easy to delete the kavo but how do you stop the h2.com file from running?

Zoggy February 27, 2008 at 7:26 pm

I ran the script and AVG after which says it’s clean. But the virus come back on the next boot.

Any ideas?

Rouel Padua February 29, 2008 at 1:24 am

The VBSCRIPT from geekside worked! Thank you very much, guys!

Danny March 1, 2008 at 8:44 am

Awesome, I’ve try and it worked on my computer. I dun hav the virus anymore and are able to open the folder without any harrasing message. Try the vbscript, it’s easy and fast to remove the virus. Thanks alot!!!

Alex March 2, 2008 at 8:37 am

Hi,
I removed amvo using the dos method. Thanks for your solution.

Danielle Zana Elfy March 3, 2008 at 4:29 am

Thanks, It fixed bothe PCs
Well done, I refered this page to many people who are infected …
Love and hugs
Danielle
((^_^))

prashant March 3, 2008 at 10:51 pm

hi..can anyone tell me how to remove virus Mad.5131
thanks in advance.

Mickey March 4, 2008 at 11:26 am

oh my gosh! thanks so much! i’ve been trying to get rid of this thing for almost an entire day now. i haven’t slept. thanks so much!

sonal jain March 8, 2008 at 2:38 pm

If you are feel that you remove all virus then beware.
because amvo.exe is a similar avpo.exe and oufddh.exe two more files.You should also check avpo0.dll,avpo1.dll in
c:\windows\system32\.
try above method to remove this files
sonal.jain13@yahoo.com

varun March 10, 2008 at 4:24 am

hi friends..i have tried all the methods starting from the first one,i am not able to solve it..
when i run command prompt it says that it cannot locate amvo.exe file….
when i use the last method it says that u r system is disinfected from the virus…….
but when i try to check the settings it is not working……please help me

varun March 10, 2008 at 4:26 am

and also friends i cannot find HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe after i run the prescribed removal method……

Ponds March 11, 2008 at 2:01 am

i have a problem with taskmanager. it didn’t display last one week. what can i do for that.

Rohit March 11, 2008 at 7:35 pm

@ Ponds

Please see the link below for solution to your problem
http://www.troublefixers.com/task-manager-disabled-problem-in-windows-xp/

sume5h March 29, 2008 at 11:13 pm

thank you man
u are a genious

Momin April 22, 2008 at 11:29 am

before the radio button used to go automatically to do not show my hidden files and folders and i couldnt use the show hiddn files and folders and now after running the script and doing few things on the registry editor the radio button automatically go to show hidden files and folders and i cant use the do not show hidden files and folders

asif April 28, 2008 at 7:12 am

very nice .prob solve.thanks

Md. Asif May 16, 2008 at 1:31 am

Woww woww wowww….its just amazing. Thanks a lot to whoever found this last solution. The 3rd and last solution is very easy to apply and it works 100%. Thanks Again friends

fazal May 16, 2008 at 5:18 am

great script mine…. It works flawlessly…. you really saved me from formatting my system.. ya its obvious that even formating wont help in this case…
Cool work… Thanks again :)

hi June 3, 2008 at 2:41 am

i have some problem with new hidden virus which hide my unhidden file n folders.this virus only hide that files n folder which they attacked besides this i can see my hidden files n folders which are not infected.

Ayim June 12, 2008 at 12:39 am

I downloaded the microhijack software and fixed HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe. i did all the steps mentioned.
now when I go to msconfi>> startup, there is no amvo.exe.
what do i do?

rajesh July 8, 2008 at 1:56 am

thank a lot ,, ur really an expert..
the steps are really simple and easy for us…

Bird Dog July 11, 2008 at 4:58 am

O/ all. Just an extra note. I had the same symptoms but my files were named CKVO.exe, CKVO1.dll, MP.cmd, 0gjn3yw.exe and kqyg5uy.dll in the temp folders of all the users.

Could find any leads on any of the AV sites.

Your method worked brilliantly! just check your Documents and Settings\?User?\local settings\temp folder for hidden files using the dir /ah option. There might be some other fishy files in there!

THANKS!
O/

tushar July 13, 2008 at 2:48 am

just go for d script provided it works…..it just rockkkkkkssssss!!!!!!

theone July 13, 2008 at 11:16 am

hey all i found new virus..even if i did complete format i.e right from partitions onwards.. that virus automatically attacks my system.That virus slows downs the system and even it stops the interenet connection.I cant able to browse net also. so pls frns tell me any remedy for that.. i have tried so manay antiviruses… with current updates… but again and again that virus is coming.. the viruses are..

MSRSD.pif
autorun.inf

even i did attrib -s -h -r .. but it generating again and again. no antivirus removing this…… so pls tell me the solution… waiting for ur response….

joelakiatan August 18, 2008 at 9:40 pm

thnks for d solution i eliminate all my viruses… it is very useful tools… thnks for the great share/….

Samson August 22, 2008 at 3:43 am

thanx 4 all ur advices
it worked initially but some days later agin the same thing happened
and now every time i start the pc , the same problem of opening the drives exists

Sanju October 1, 2008 at 8:31 am

I have 2 Gb pen drive transcend . When i insert a pen drive in my HLC laptop. it shows write protect & use another Disk.
And also same Pen drive insert an other desktop computer it is Ok, No problem??

What is the problem?
Plea. Solve the problem?

from
Sanju

Rebecca October 14, 2008 at 1:06 am

hey, i got prob in my comp, that it’s threated by WIN32/Sality… could u help me how to clean the virrus? if tried with AVG8, but its not succesfull to clean the virus… the virrus is making the computer working sooooooooo slow. n i couldn’t open some files in my comp… really need help n solution for this probb… thanks

*rebecca

NIKI November 26, 2008 at 2:13 am

I have a very serious problem .Please provides me its solution. Both of my TASK MANAGER & REGEDIT (REGISTRY EDITOR) enabled & when i type on Start->Run REGEDIT to open REGISTRY EDITOR & want to check it then message come & computer will Restart. & same for TASK MANAGER. From internet i check & find many solution for both but when i implement for one moment TASKMANAGER option show enable , When i click on it to see Processes it give same above message & computer Rrstart . I think there are some very harmful virus which disabled them .I have installed AVG latest verson but it does not catch virus which disabled both TaskManager & Regedit .So please provide me its better solution if you have. I apply this solution & many others from net but all can not solve this problem.http://www.raymond.cc/blog/archives/2007/06/28/restore-task-manager-regedit-and-folder-options-disabled-by-virus/

naina January 14, 2009 at 7:00 am

gosh! i got tired of trying everything but procedure provided by “another_way” really worked..

thanks man… :)

Selvakumaran January 29, 2009 at 4:56 am

the script file is working fine.

thanks for your update.

Tiyash Paul March 24, 2009 at 11:30 am

Well, does the reg edit method delete the virus which actually caused the problem in the first place.. ?? My problem is solved, just a curiosity..

jitendra April 2, 2009 at 9:59 am

Thanx Buddy…

kill_amvo_virus_usb_en .. solved the problem..

Thanks a ton :)

Gunjan November 13, 2009 at 7:42 am

I am unable to open any folder, 1) from RUN, 2) by clicking on Folder’s shortcut.
Earlier, as soon as the folder was opening, I was getting a messagebox,”Cannot find eksplorasi.exe”
So I did the following changes:-
1) from REGEDIT, HKEY_LOCAL_MACHINE>SOFTWARE>Microsoft>Windows NT>CurrentVersion>Winlogon

2) In the right panel, locate the following entry: * On Windows ME, 2000, XP, and Server 2003
Shell = “Explorer.exe “%Windows%\Eksplorasi.exe””
* On Windows NT
Shell = “Explorer.exe “\eksplorasi.exe””

Right-click on this registry entry and choose Modify. Change the value to this

Shell = “Explorer.exe”

Now, as soon as the folder opens, its getting closed as well or in task manager its shows, “Not Responding”
I’ve AVG installed on my system, but its not detecting any virus. Also I dont know whether its due to Virus or due to some system setting.

Please help me out in this..

Thanks in ADVANCE..

Polymath..

ajaiy January 17, 2010 at 12:50 pm

when i type regedit
prompts come with
re edit has been disabled by administrator,
please help me out

chee April 10, 2010 at 12:34 pm

yes, these steps below worked for my pc, thanks Chris

1. Go to your Start menu, click on Run and open up your Registry Editor by typing: regedit
2. Once there go to: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folde r\Hidden\SHOWALL
3. Double click the value called CheckedValue, and modify its data value (DWORD Value) to 1 (0×00000001)

lyn Ai December 25, 2010 at 6:08 pm

wow! i downloaded the vbs stuff at mygeekside.com as suggested and it did its job!!! sooo great 😛 no fuss no hussle it showed my hidden folders like a MIRACLE!! thank you ssooo much!!

gerry July 9, 2012 at 10:39 am

xory guys i have enterd the command “attrib -r-h-s autorun.inf ” it keeps sayng the command isnt recognizd as internal or external command why plze smeone help it

Leave a Comment

Previous post:

Next post:

© TroubleFixers – All about fixing computer troubles2007-2016 . All Rights Reserved.