What is Amvo.exe?

Amvo.exe is Trojan/Backdoor

Symptoms:

-Folder Option is not working - you cannot enable the Folder Option or show the hidden files running into you computer.
-Hidden file problem
-Always open new windows in all drives
-Error occur of the memory reference (Low Disk Space)

Remove Amvo.exe virus from computer.

1). Uncheck amvo.exe from msconfig>> startup (type msconfig in run and click on the startup tab) also and restart your system

2). Click Start > Run and type REGEDIT

3). Go to HKEY_CURRENT_USER > SOFTWARE > Microsoft > Windows > CurrentVersion > Explorer > Advanced

4). On the right side, double click the hidden value and give it a value of 1.

5). Same for HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Explorer > Advanced > Folder > Hidden > SHOW ALL Change the value of Checked Value to 1.

6). Check if your Folder Option if its working now. If it works! OK you are now ready to delete the Amvo.exe virus now.

Go to your Folder Option and enable the show all the hidden files and you remove the following files if they are exist in the exact location or directory:

c:\autorun.inf
c:\u.bat
c:\amvo.exe
c:\awda2.exe
c:\d.com
c:\mvo.dll
c:\amvo1.dll
c:\windows\system32\ amvo.exe
c:\windows\system32\ awda2.exe
c:\windows\system32\ d.com
c:\windows\system32\ mvo.dll
c:\windows\system32\ amvo1.dll
c:\windows\system32\u.bat

Lastly go to Run and type cmd then type regedit, press Ctrl + F to find the files amvo.exe and delete it. After that, reboot your PC.

Amvo.exe removal

To get rid run regedit, find all keys related to amvo.exe or the name of the virus.

In Start > Run > msconfig you can find the amvo.exe or its variants.

Remove all occurrence of the name from regedit.

Reboot the System.

Reboot and do the following changes to the Registry using regedit

(To start regeditor go to: START > RUN > REGEDIT)

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer searchidden en 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer searchsystemdirs en 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\Advanced hidden en 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\Advanced showsuperhiden en 1

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\Advanced superhiden en 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN CheckedValue 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\NOHIDDEN DefaultValue 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL CheckedValue 1

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL DefaultValue 1

HKEY_CURRENT_USER\Software\Microsoft\

Windows\CurrentVersion\Policies\Explorer NoDriveTypeAutoRun 0x00000091 (145)

From all the drives delete the autorun.inf using command line (if on windows) or from a linux OS.
Do not open the drive from the explorer as it would spread the virus again to this OS.
If you have linux installed and can access all partitions on the disk,
go delete the files and clear the trash on all drives.

Do necessary changes as in Step 2, if you have not done those.

Start > Run > gpedit.mscbr

Enable : Computer Configuration > Administrative Templates > System > Turn Off Autoplay

How to Delete Amvo.exe virus.

1). Go to Start > Search > All Files or Folders.

2). In the "All or part of the the file name" section, type in "amvo.exe" file name(s).

3). To get better results, select "Look in: Local Hard Drives" or "Look in: My Computer" and then click "Search" button.

4). When Windows finishes your search, hover over the "In Folder" of "amvo.exe", highlight the file and copy/paste the path into the address bar. Save the file's path on your clipboard because you'll need the file path to delete amvo.exe in the following manual removal steps.

1). To open the Windows Task Manager, use the combination of CTRL+ALT+DEL or CTRL+SHIFT+ESC.

2). Click on the "Image Name" button to search for "amvo.exe" process by name.

3). Select the "amvo.exe" process and click on the "End Process" button to kill it.

1). To open the Windows Command Prompt, go to Start > Run > cmd and then press the "OK" button.

2). Type in "dir /A name_of_the_folder" (for example, C:\Spyware-folder), which will display the folder's content even the hidden files.

3). To change directory, type in "cd name_of_the_folder".

4). Once you have the file you're looking for type in del "name_of_the_file".

5). To delete a file in folder, type in "del name_of_the_file".

6). To delete the entire folder, type in "rmdir /S name_of_the_folder".

7). Select the "amvo.exe" process and click on the "End Process" button to kill it.