Search this blog

Monday, April 21, 2008

How To Remove The ntde1ect.com and autorun.inf Files

There is a Trojan/virus (either the Win32/Pacex virus or the Win32/PSW.Agent.NDP trojan) that uses the two files ntde1ect.com and autorun.inf. Here is how you can get rid of them :

  • Open Task Manager and in Processes tab end explorer.exe and wscript.exe process
  • Open up File –> New Task (Run) in the Task manager
  • Type cmd and hit Enter
  • Type
  • del /a:h /f c:\autorun.*
  • Go to your Windows\System32 directory by typing cd c:\windows\system32
  • Type dir /a:h /f avp*.*
  • If you see any files names avpo.dll or avpo.exe or avpo.exe, use the
  • Del /a:h /f avpo.exe
  • Open up File –> New Task (Run) in the Task manager, Type regedit
  • Navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
  • If there are any entries for avpo.exe, delete them.
  • Do a complete search of your registry for ntdelect.com and delete any entries you find.
  • To Restore Folder Options Settings, Navigate to
  • HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL

No comments: