Removing the ntde1ect.com and autorun.inf files

There is a trojan/virus (either the Win32/Pacex virus or the Win32/PSW.Agent.NDP trojan) that uses those two files. Here is how you can get rid of them:

1) Open up Task Manager (Ctrl-Alt-Del)

2) If wscript.exe is running, end it.

3) If explorer.exe is running, end it.

4) Open up “File | New Task (Run)” in the Task manager

5) Run cmd

6) Run the following command on all your drives by replacing c: with other drives in turn (note: if you have autorun.inf files that you think you need to backup, do so now):

del c:autorun.* /f /a /s /q

7) Go to your WindowsSystem32 directory by typing cd c:windowssystem32

Type dir /a avp*.*

9) If you see any files names avp0.dll or avpo.exe or avp0.exe, use the following commands to delete each of them:

attrib -r -s -h avpo.exedel avpo.exe

10) Use the Task Manager’s Run command to fire up regedit

11) Navigate to HKEY_CURRENT_USER SOFTWARE Microsoft Windows CurrentVersion Run (as usual, take a backup of your registry before touching it!)

12) If there are any entries for avpo.exe, delete them.

13) Do a complete search of your registry for ntde1ect.com and delete any entries you find.

14) Restart your computer