How to remove Win32/NSAnti, d.com virus (Autorun virus, AVMO virus, Hidden Files problem)


Recently a virus called d.com is spreading with the pendrives a lot. Here I’ll discuss how to remove the infection without any use of antiviruses.

If your system is infected by this virus you can’t see hidden files and folders , even after applying the settings in “Folder Options” show hidden folders. This setting is reverted back to Don’t show hidden files and folders by the virus.

This happens because virus protects the two hidden ,system files called d.com and autorun,inf which are created by amvo.exe and amvo0.dll , amvo1.dll which resides in system32 folder on the OS drive (hard disk partition on which windows operating system is installed).

Solution: In order to get rid of the virus you will need to delete all files the virus creates and resides into. Here’s how you will do it.

  1. Open Start>>Run and type cmd and press enter. This will open windows command prompt window. On this window, type as directed in steps further and press enter at the end of each step.
  2. type cd\
  3. type cd windows\system32
  4. type attrib -r -h -s amvo.exe
  5. type del amvo.exe
  6. type attrib -r -h -s avmo0.dll ,repeat the steps 5 and 6 again to delete avmo1.dll
  7. now type d: and press enter for d: drive partition.
  8. type attrib -r -h -s autorun.inf
  9. type del autorun.inf
  10. type attrib -r -h -s d.com
  11. type del d.com
Similarly repeat from steps 8 to 11 for all your hard disk partitions to remove the files created by the virus.
The above is manual method but for who dont have command prompt level understanding they can use the method below:
Recently a virus called d.com is spreading with the pendrives a lot. Here I’ll discuss how to remove the infection without any use of antiviruses.

If your system is infected by this virus you can’t see hidden files and folders , even after applying the settings in “Folder Options” show hidden folders. This setting is reverted back to Don’t show hidden files and folders by the virus.

This happens because virus protects the two hidden ,system files called d.com and autorun,inf which are created by amvo.exe and amvo0.dll , amvo1.dll which resides in system32 folder on the OS drive (hard disk partition on which windows operating system is installed).

Solution: In order to get rid of the virus you will need to delete all files the virus creates and resides into. Here’s how you will do it.

  1. Open Start>>Run and type cmd and press enter. This will open windows command prompt window. On this window, type as directed in steps further and press enter at the end of each step.
  2. type cd\
  3. type cd windows\system32
  4. type attrib -r -h -s amvo.exe
  5. type del amvo.exe
  6. type attrib -r -h -s avmo0.dll ,repeat the steps 5 and 6 again to delete avmo1.dll
  7. now type d: and press enter for d: drive partition.
  8. type attrib -r -h -s autorun.inf
  9. type del autorun.inf
  10. type attrib -r -h -s d.com
  11. type del d.com

Similarly repeat from steps 8 to 11 for all your hard disk partitions to remove the files created by the virus. The above method is manual attempt to eliminate the virus. But some people will have difficulty following that manner. For them an easier method below:

  1. First download Trend Micro HijackThis from here
  2. Install and run the scan ,you will see an entry like this :  HKCU\..\Run: [amva] C:\WINDOWS\system32\amvo.exe
  3. Check the above entry and click on the button which says Fix Checked and click yes on the prompt.
  4. Uncheck amvo.exe from msconfig>> startup (type msconfig in run and click on the startup tab) also and restart your system
  5. Open my computer and go to folder options >> check the option show hidden files and folders. Also un-check the option Hide protected operating system files (This will give a warning message, confirm by pressing yes button). After this click Ok.
  6. Now access all your system drives by typing the drive letters in the address bar (for example c:) and delete the files like autorun.inf and other file d.com
  7. Also delete the files amvo.dll and amvo1.dll from windows/system32 folder.

4 thoughts on “How to remove Win32/NSAnti, d.com virus (Autorun virus, AVMO virus, Hidden Files problem)

  1. Interesting blog! Is your theme custom made or did you download it from somewhere?
    A design like yours with a few simple tweeks would really make my blog stand out.
    Please let me know where you got your design. Thanks

    • Of course this is not a custom made theme. And few simple tweaks would indeed make it stand out. But didn’t feel like yet.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s