1. Click “Start” -> “Run…” (or press Windows key + R)
2. Type “regedit” and click “Ok”.
3. Find the key : [sourcecode language='html']HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL[/sourcecode]
4. Look at the “CheckedValue” key… This should be a DWORD key. If it isn’t, delete the key.
5. Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1.
6. The “Show hidden files & folders” check box should now work normally. Enjoy!

1. Show Hidden Files and Folders not working.
2. My Computer Drives open another explorer window.
3. When you run a program, just in 2 or 3 minutes the program dissappears (Actually runs in background but you can not see its window in foreground).

Removal of this Virus

Unfortunately, I have no removal tool to remove this virus at the time of writing, but you will soon see one. You can try the manual removal of it.

Manual Removal

Caution : While the manual process is going on, do not open any My Computer drive.

1. Open up cmd by typing cmd in Start –> Run.

2. Type in cmd

[sourcecode language='html']taskkill /f /im smss.exe

taskkill /f /im killer.exe[/sourcecode]

3. The virus placed some files at the root of every drive so you need to clean them.

Repeat the following commands on cmd for all your drives (Here it is applied for C drive)

[sourcecode language='html']del /a:h /f c:\autorun.inf

del /a:h /f c:\smss.exe

del /a:h /f c:\funny ust scandal.avi.exe[/sourcecode]

4. Now you need to delete files in windows folder so type :

[sourcecode language='html']del /a:h /f c:\windows\killer.exe

del /a:h /f c:\windows\autorun.inf

del /a:h /f c:\windows\smss.exe

del /a:h /f c:\windows\funny ust scandal.exe[/sourcecode]

5. Now you need to delete one more file :

[sourcecode language='html']del /a:h /f “%userprofile%\StartMenu\Programs\Startup\lsass.exe”[/sourcecode]

6. Use PowerExes to delete startup entries like.

smss.exe

lsass.exe(if it does not remove then only uncheck it)

killer.exe

7. To restore Folder Option Settings Follow this page

Show Hidden Files And Folders Not Working

8. To Remove the virus from Flash Drive, Insert a flash drive cancel any Autoplay box.

Open cmd and type (Replace x by your usb drive letter)

[sourcecode language='html']del /a:h /f x:\autorun.inf

del /a:h /f x:\smss.exe

del /a:h /f x:\funny ust scandal.avi.exe[/sourcecode]

• Open Task Manager and in Processes tab end explorer.exe and wscript.exe process
• Open up File –> New Task (Run) in the Task manager
• Type cmd and hit Enter
• Type

[sourcecode language='html']del /a:h /f c:autorun.*[/sourcecode]

• Go to your WindowsSystem32 directory by typing

[sourcecode language='html']cd c:windowssystem32[/sourcecode]

• Type

[sourcecode language='html']dir /a:h /f avp*.*[/sourcecode]

• If you see any files names avpo.dll or avpo.exe or avpo.exe, use the

[sourcecode language='html']Del /a:h /f avpo.exe[/sourcecode]

• Open up File –> New Task (Run) in the Task manager, Type

[sourcecode language='html']regedit[/sourcecode]

• Navigate to

[sourcecode language='html']HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersionRun[/sourcecode]

• If there are any entries for avpo.exe, delete them.
• Do a complete search of your registry for ntdelect.com and delete any entries you find.
• To Restore Folder Options Settings, Navigate to

[sourcecode language='html']HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindowsCurrentVersionExplorerAdvancedFolderHiddenSHOWALL[/sourcecode]

Look at the “CheckedValue” key. This should be a DWORD key. If it isn’t, delete the key. Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1. The “Show hidden files & folders” check box should now work normally.

To correct all these options, use Ravmon Virus Removal Tool

• Restore Windows Default Settings
• Check Restore All Folder Options
• OK.

Download Ravmon Virus Removal Tool

Go to registry editor by running regedit in the run box.

Go to this key:

[sourcecode language='cpp']HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersionExplorerAdvanced[/sourcecode]

In the right hand area, double click hidden and change the value to 1.

Now you’re all set to go. Check it in your tools menu if the changes have taken effect. Mine have already been fixed . Please spare a few moments from your precious time and tell us about your experiences.