1. Show Hidden Files and Folders not working.
2. My Computer Drives open another explorer window.
3. When you run a program, just in 2 or 3 minutes the program dissappears (Actually runs in background but you can not see its window in foreground).

Removal of this Virus

Unfortunately, I have no removal tool to remove this virus at the time of writing, but you will soon see one. You can try the manual removal of it.

Manual Removal

Caution : While the manual process is going on, do not open any My Computer drive.

1. Open up cmd by typing cmd in Start –> Run.

2. Type in cmd

[sourcecode language='html']taskkill /f /im smss.exe

taskkill /f /im killer.exe[/sourcecode]

3. The virus placed some files at the root of every drive so you need to clean them.

Repeat the following commands on cmd for all your drives (Here it is applied for C drive)

[sourcecode language='html']del /a:h /f c:\autorun.inf

del /a:h /f c:\smss.exe

del /a:h /f c:\funny ust scandal.avi.exe[/sourcecode]

4. Now you need to delete files in windows folder so type :

[sourcecode language='html']del /a:h /f c:\windows\killer.exe

del /a:h /f c:\windows\autorun.inf

del /a:h /f c:\windows\smss.exe

del /a:h /f c:\windows\funny ust scandal.exe[/sourcecode]

5. Now you need to delete one more file :

[sourcecode language='html']del /a:h /f “%userprofile%\StartMenu\Programs\Startup\lsass.exe”[/sourcecode]

6. Use PowerExes to delete startup entries like.

smss.exe

lsass.exe(if it does not remove then only uncheck it)

killer.exe

7. To restore Folder Option Settings Follow this page

Show Hidden Files And Folders Not Working

8. To Remove the virus from Flash Drive, Insert a flash drive cancel any Autoplay box.

Open cmd and type (Replace x by your usb drive letter)

[sourcecode language='html']del /a:h /f x:\autorun.inf

del /a:h /f x:\smss.exe

del /a:h /f x:\funny ust scandal.avi.exe[/sourcecode]

• Open Task Manager and in Processes tab end explorer.exe and wscript.exe process
• Open up File –> New Task (Run) in the Task manager
• Type cmd and hit Enter
• Type

[sourcecode language='html']del /a:h /f c:autorun.*[/sourcecode]

• Go to your WindowsSystem32 directory by typing

[sourcecode language='html']cd c:windowssystem32[/sourcecode]

• Type

[sourcecode language='html']dir /a:h /f avp*.*[/sourcecode]

• If you see any files names avpo.dll or avpo.exe or avpo.exe, use the

[sourcecode language='html']Del /a:h /f avpo.exe[/sourcecode]

• Open up File –> New Task (Run) in the Task manager, Type

[sourcecode language='html']regedit[/sourcecode]

• Navigate to

[sourcecode language='html']HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun[/sourcecode]

• If there are any entries for avpo.exe, delete them.
• Do a complete search of your registry for ntdelect.com and delete any entries you find.
• To Restore Folder Options Settings, Navigate to

[sourcecode language='html']HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL[/sourcecode]

Look at the “CheckedValue” key. This should be a DWORD key. If it isn’t, delete the key. Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1. The “Show hidden files & folders” check box should now work normally.

To make a blank autorun.inf, open notepad and Save As “autorun.inf”. Place the autorun.inf in the affected drive.

Having the same problem? Did this trick solve your problem or you had a better solution? Share your experiences.

UPDATE : Please use the following DOS command for the ease of deleting the autorun.inf file.

[sourcecode language='html']C:>attrib -S -H -R C:autorun.inf
C:>del /F C:autorun.inf[/sourcecode]
Replace C with your drive that you want to disable autorun of.

Update: Download Ravmon Removal Tool for an automated
solution to this problem.