Advertisements

How to remove the ntde1ect.com and autorun.inf files

There is a Trojan/virus (either the Win32/Pacex virus or the Win32/PSW.Agent.NDP trojan) that uses the two files ntde1ect and autorun.inf Here is how you can get rid of them:

  • Open Task Manager and in Processes tab end explorer.exe and wscript.exe process
  • Open up File –> New Task (Run) in the Task manager
  • Type cmd and hit Enter
  • Type
    del /a:h /f c:\autorun.*
  • Go to your Windows\System32 directory by typing cd c:\windows\system32
    Type dir /a:h /f avp*.*
     If you see any files names avpo.dll or avpo.exe or avpo.exe, use the     

    Del /a:h /f avpo.exe

  • Open up File –> New Task (Run) in the Task manager, Type regedit
  • Navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    If there are any entries for avpo.exe, delete them.
    Do a complete search of your registry for ntdelect.com and delete any entries you find.
  • To Restore Folder Options Settings, Navigate to
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\

          Explorer\Advanced\Folder\Hidden\SHOWALL

         Look at the “CheckedValue” key… This should be a DWORD key. If it isn’t,  delete the key.Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1. The “Show hidden files & folders” check box should now work normally.

Advertisements

32 Responses

  1. In my opinion you guys are doing a very good job ur provided solutions are very effective,so i personally thought to share a problem with you.
    One of my friends pc got infected with some virus or some worm,the virus is of very different type what it does is it creates a folder with .exe extension of approx 38kb size and hides the original folder by changing its attribute to hidden and system file. Now about the new folder created i got the the solution from u guys but my main problem which cant be resolved till now that the original folder which gets hidden when i unhide the folder by going in folder option and unchecking the option (HIDE PROTECTED OPERATING SYSTEM FILES) the file is visible but when i check its attributes the HIDDEN attribute is permanently greyed and cant be changed so kindly help me out with some solution I will be very much greatful to you

    Thanks
    Datar Singh

  2. http://hiteshzone.co.nr/

    visit this …………………………….

  3. it works… still my flash disk is causing problem. when i plug it it creates some files that are taken by mcafee as PUP

  4. hi
    when i start my system after downloading windows the message comes “windows cannt find svichossst.exe make sure you type the name correctly and then try again, to search for a file click the start button & then click search.

  5. Dear fida,
    Just open regedit,
    Go to HKLM\SOFTWARE\Microsoft\WindowsNT\
    CurrentVersion\Winlogon, Shell
    has been change to -> explorer.exe svichosst.exe
    when it should be -> explorer.exe

  6. Thank You from SLU ECE of Baguio, room H306! Haha..

  7. removal tool available…….

    visit… http://www.bibzworld.com

  8. removal tool available…….

    visit… http://www.bibzworld.co.nr

  9. We had problems with autorun.inf virus.
    Thanx
    Your solution worked out well…

    Albert

  10. My friends had this problem I solved it :
    Entered the drive using run “c:”,
    opened “cmd”,reached c:\>,typed “attrib -s -h”
    from “msconfig” removed “avpo” as startup item.rebooted in safe mode(F8 during bootup) and deleted “avpo.exe”,”avpo1.dll”,”avpo.dll” from “c:\windows\system32\”
    before that i typed “attrib -s -h” in “cmd” from c:\windows\system32>
    rebooted.
    modified registry entry
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ Explorer\Advanced\Folder\Hidden\SHOWALL
    “CheckedValue” to value of “1”.initially it was “0”

  11. And then deleted the autorun.inf and ntde1ct.com from all drives by showing all files and folders and showing system files.
    repeating for all drives

  12. guys i m still unable to resolve as i m still unable to access or use my external harddrive as when ever i open my external hardrive it shows me the

  13. @saurabh
    plz read my post above …u will b able to solve ur problem with ease!!

  14. Still i cant repair my autorun.inf virus and folder hiding

  15. Hi,
    I go through all the programs.
    Now I found the file in my pen drive.
    How can I delete this file Autorun.inf.
    It’s detcted by anti-virus but cannnot be removed.
    I try to delete it from Dos but its no use.
    Please Help me.
    Thank you in advance.

  16. HI,
    FRIENDS, pls help me in solving the following problem.
    1)while opening any of the drive (eg:-c: or d:)error msg “ntde1ect.com-application error” is appearing.

    2)only open first double clik any floder own window. After any folder open same window in the same colon.
    {ex: c:\window open separatly after open system32 open in same window of second window}

    how to rectify same window first double click in the folder.

    3)can not view the hiten files.

    MY SIDE REMIDDY TAKEN:(STILL NOT SOLVED THE PROBLEM).

    1)OPERATING SYSTEM REINSTALLED.

    2)GOOD AND BEST WORKING OS GOSTED IN THIS PC.
    PLS SLUTION TO ME.

  17. i had a problem with the ntde1ct virus.i tried to follow wat u had mentioned here.bt sumhow im not able to open my task manager..because as i try opening it ,it closes itself in a second.so im unable to understand wat to do.and am not able to view my hidden files either.try to help meo ut as soon as possible.

  18. Mutant,

    Thanx a bunch 4the autorun/ntde1ect removal procedure.

    It worked!!

    I successfully deleted the autorun.inf and ntde1ect.com files from my removable flash disk.

    emptydebes.

  19. ya i also successfull to open my drives by double click..thanks!!!!!

  20. In my computer tools menu in view option, Hidden files and folders one radio button is missing,show hidden files and folder.How to ressolve this problem

  21. Ive written a detailed blog about removing the autorun.inf virus and other issues at http://andback.wordpress.com

    also talks about removing those viruses which even the antivirus cant remove and to revert back to settings prior to infection.

    Hope this helps too.

  22. thanks a million about the ntde thing.

  23. very strong viruse inter memory how con remove
    pls help me

  24. very strong viruess inter memory how to remove help me

  25. please help me delete this auto.exe and autorun.inf file from my computer.

  26. F*cking GREAT!!! thank you so much…. haha… i finally get rid of the autorun.inf…. god bless!!!

    manila, philippines

  27. i have tried to apply all the procedure mentioned above but not successed. The pop up is still poping up for autorun.inf detected as Generic!atr. detection type Trojan. Any solution

  28. >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
    There is a Trojan/virus (either the Win32/Pacex virus or the Win32/PSW.Agent.NDP trojan) that uses the two files ntde1ect and autorun.inf Here is how you can get rid of them:
    Open Task Manager and in Processes tab end explorer.exe and wscript.exe process
    Open up File –> New Task (Run) in the Task manager
    Type cmd and hit Enter
    Type
    del /a:h /f c:\autorun.*
    Go to your Windows\System32 directory by typing cd c:\windows\system32
    Type dir /a:h /f avp*.*
    If you see any files names avpo.dll or avpo.exe or avpo.exe, use the

    Del /a:h /f avpo.exe
    Open up File –> New Task (Run) in the Task manager, Type regedit
    Navigate to HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    If there are any entries for avpo.exe, delete them.
    Do a complete search of your registry for ntdelect.com and delete any entries you find.
    To Restore Folder Options Settings, Navigate to
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\

    Explorer\Advanced\Folder\Hidden\SHOWALL

    Look at the “CheckedValue” key… This should be a DWORD key. If it isn’t, delete the key.Create a new key called “CheckedValue” as a DWORD (hexadecimal) with a value of 1. The “Show hidden files & folders” check box should now work normally.

    >>>>>>>>>>>>>

  29. Thanks so much. It worked for me. I was able to get rid of all of them from the machine.

  30. i can’t find wscript.exe

  31. your steps worked.thank you very much guys

  32. hi all,i have done the same process which u have told but i cant get removed still what to do now…..some one help me please

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: