try this procedure:
- Open Task Manager and in Processes tab end explorer.exe and wscript.exe process
- Open up File –> New Task (Run) in the Task manager
- Type cmd and hit Enter
Type
del /a:h /f c:\autorun.*
if you have multiple drive/partition, repeat this step to all drive/partition, make replacing “C:†with the appropriate drive letter.
- Go to your Windows\System32 directory by typing cd c:\windows\system32
Type dir /a:h /f hbq*.*
- If you see any files named hbq0.dll or hbq0.exe or hbo.exe, use the
Del /a:h /f avp*.exe
Del /a:h /f avp*.dll
to delete.
- Open up File –> New Task (Run) in the Task manager, Type regedit
- Navigate to:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
If there are any entries for kxvo.exe, delete them. Also delete all suspicious items
- Do a complete search of your registry for ntdelect.com or hbq.exe or kxvo.exe and delete any entries you find.
- To Restore Folder Options (“Show hidden files & foldersâ€ÂÂÂ) Settings, Navigate to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Advanced\Folder\Hidden\SHOWALL
- Look at the “CheckedValue†key… This should be a DWORD key. If it isn’t, delete the key. Create a new key called “CheckedValue†as a DWORD (hexadecimal) with a value of 1. The “Show hidden files & folders†check box should now work normally.
