FrEn

E-mail Print PDF

Amvo.exe remover - Patch to remove the virus amvo.exe and all its variants

Written by Administrator  |  Friday, 18 September 2009 08:04
Virus information

The virus Amvo.exe is propagated through partition and removable disk, the virus copies periodically "autorun.inf" and other files depending on the variant of the virus in all the partition of your system, if you remove them, these two files will go back to their places a few seconds after his suppression.

We are not going to tell you its particularity of each virus but we will tell you in totality.
Just a little precision, all virus that patchs are already availables in this site are not included in this patch.

File

The virus puts files in system repertory:

  • <System>\amvo.exe
  • <System>\amvo0.dll
  • <System>\amvo1.dll

And stores too two files in the temporary repertory:

  • fq9.dll
  • help.exe
  • 2nux4.dll
  • 5.dll
  • 92izu.dll
  • dykvagp.dll
  • e.dll
  • e7sf4.dll
  • ezk.dll
  • fqlq.dll
  • pelqe.dll
  • vupin8b.dll
  • w4enx.dll
  • zmcc.dll
  • k2fvpt.dll
  • e7sf4.dll
  • fgshabuifhdvmis32.exe
  • RarSFX0\32.exe
  • 2m9mdmy.dll
  • w2e.sys
  • ...

And puts two files per variant in the root folder of all partition and removable disk:

  • Autorun.inf
  • 3o.exe
  • y82td3td.com
  • i.cmd
  • fppg1.exe
  • ekugb3.bat
  • ...
Registry Registry entries created

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    • amva="<System>\amvo.exe"

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32

Values created
  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}\InProcServer32
    • (Defaul) = <Windows>\HELP\F3C74E3FA248.dll
    • ThreadingModel = Apartment

  • HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1DBD6574-D6D0-4782-94C3-69619E719765}
    • (Default) = SSUUDL

  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
  • {1DBD6574-D6D0-4782-94C3-69619E719765} = ""



WARNING

This virus runs automatically each time you open or explore a partition, it is preferable to download the patch and unpack it on the desktop, reboot your machine in Safe Mode and run the patch, always in safe mode.

This virus attempt to connect to this adresses

  • http://www.microsoftmg.com/gut/mgg.exe
  • http://www.om7890.com/mf2/help.rar

Which engenders the downloading of this two files.

Download

 

Comments  

 
0 #1 Dabomb 2010-01-12 17:16
ok
Quote
 

Add comment


Security code
Refresh

Related articles
Latest posts
Free malware removal tool to remove Antivirus Soft
_WRITTEN_BY Administrator 02/02/2010

Antivirus Soft is another rogue Antispyware, a scareware, that tries to get money from users by prompting them to register and buy their fake products. Some old malwares often return to the front…Read more...

Free malware removal tool to remove Vista Guardian 2010
_WRITTEN_BY Administrator 01/02/2010
Vista Guardian 2010 is a rogue antispyware that may reprensent security risk for your system, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake…Read more...
Free malware removal tool to remove APcSecure
_WRITTEN_BY Administrator 30/01/2010

APcSecure is another fake antivirus which installs itself on your system with/without your will. This fake Antivirus comes from WiniSoft family, they have just changed the name of the application,…Read more...

Free malware removal tool to remove APcSafe
_WRITTEN_BY Administrator 30/01/2010

APcSafe is another fake antivirus which installs itself on your system with/without your will. This fake Antivirus comes from WiniSoft family, they have just changed the name of the application,…Read more...

Free malware removal tool to remove AntiSpyware 2010
_WRITTEN_BY Administrator 29/01/2010
AntiSpyware 2010 is a rogue Antispyware  that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your system; you are warned by a fake alarm that there are…Read more...
.
Information | Contact

© All Rights Reserved. net-studio.org 2009