[How To Remove] ntde1ect.com And autorun.inf Files

There is a Trojan/virus (either the Win32/Pacex virus or the Win32/PSW.Agent.NDP trojan) that uses the two files ntde1ect.com and autorun.inf. Here is how you can get rid of them :

• Open Task Manager and in Processes tab end explorer.exe and wscript.exe process
• Open up File –> New Task (Run) in the Task manager
• Type cmd and hit Enter
• Type

[sourcecode language='html']del /a:h /f c:autorun.*[/sourcecode]

• Go to your WindowsSystem32 directory by typing

[sourcecode language='html']cd c:windowssystem32[/sourcecode]

• Type

[sourcecode language='html']dir /a:h /f avp*.*[/sourcecode]

• If you see any files names avpo.dll or avpo.exe or avpo.exe, use the

[sourcecode language='html']Del /a:h /f avpo.exe[/sourcecode]

• Open up File –> New Task (Run) in the Task manager, Type

[sourcecode language='html']regedit[/sourcecode]

• Navigate to

[sourcecode language='html']HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun[/sourcecode]

• If there are any entries for avpo.exe, delete them.
• Do a complete search of your registry for ntdelect.com and delete any entries you find.
• To Restore Folder Options Settings, Navigate to

[sourcecode language='html']HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL[/sourcecode]

Look at the “CheckedValue” key. This should be a DWORD key. If it isn’t, delete the key. Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1. The “Show hidden files & folders” check box should now work normally.