NTDE1ECT woes

Viruses, hackers and crackers
Post Reply
I34z1k
Registered User
Posts: 8142
Joined: 05 Dec 2003, 02:00
Location: Dry Ice factory

NTDE1ECT woes

Post by I34z1k »

Hey guys

My bro got this virus or whatever it is. So far it seems to just be affecting his explorer. I have googled around a bit for it and I can't find much useful. Tried BitDefender, AVG and Norton (he did :P) Help please? And good free anti-virus out atm?

Thanks
Mike
WiK1d
Registered User
Posts: 20732
Joined: 13 Sep 2004, 02:00
Location: Cruising the streets of Pretoria
Contact:

Post by WiK1d »

There is a trojan/virus (either the Win32/Pacex virus or the Win32/PSW.Agent.NDP trojan) that uses those two files. Here is how you can get rid of them:

1) Open up Task Manager (Ctrl-Alt-Del)
2) If wscript.exe is running, end it.
3) If explorer.exe is running, end it.
4) Open up “File | New Task (Run)” in the Task manager
5) Run cmd
6) Run the following command on all your drives by replacing c:\ with other drives in turn (note: if you have autorun.inf files that you think you need to backup, do so now):

del c:\autorun.* /f /a /s /q

7) Go to your Windows\System32 directory by typing cd c:\windows\system32
8) Type dir /a avp*.*
9) If you see any files names avp0.dll or avpo.exe or avp0.exe, use the following commands to delete each of them:

attrib -r -s -h avpo.exe
del avpo.exe

10) Use the Task Manager’s Run command to fire up regedit
11) Navigate to HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run (as usual, take a backup of your registry before touching it!)
12) If there are any entries for avpo.exe, delete them.
13) Do a complete search of your registry for ntde1ect.com and delete any entries you find.
14) Restart your computer.



Just follow the steps given below

1. Open Task Manager is check for the process names ntde1ect.com, if running kill the process.

2. Not Search for the file avp0.exe and delete it. Mostly it will be in %systemroot%\system32 folder. Remember this file is stored with hidden and system attribute, though it not a system file. follow these steps to delete this file
I. open command prompt.
II. to search the file type dir avp0.exe /s /a
III. Now change the attribute of file using command attrib -H -S -R <filename with full path >
IV. now delete the file using del <Filename with full path>

3. Also to the following registry value using regedit
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run
avpa

if exist delete this value.

4. Now Browse to the registry key
HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion\Explorer\MountP...

and Search in sub keys for ntde1ect.com
and delte it.

5. Restart you computer.
Seems that it's Malware, try using Adaware or Spybot to get rid of it?
Anthro
Moderator Emeritus
Posts: 5547
Joined: 21 Dec 2002, 02:00
Processor: i7 3770k
Motherboard: ASUS P8P67-Pro
Graphics card: 2xNvidia GTX670
Memory: 16 GB Gskill Sniper
Location: In SQL Space inserting 'null' on purpose
Contact:

Post by Anthro »

If it is not resolved yet - please ask him to download Hijackthis - and post the logs here ?then can take a look
Temporary Absence
Post Reply