Friday, March 13, 2009

How to remove NTDETEC1.EXE virus in windows

There maybe a chance or unfortunate that ur machine gets infected with NTDETEC1.EXE virus.
This virus will Disable ur Task manager, Registry as well as folder option cant be accesed to view the hidden folders and files.
This virus and its related files are hidden and cant be deleted from explorer bcecause folder option is disabled too due to it.
The files related to this virus are as below:
\ntdetec1\ntdetec1.exe
\ntdetec1\cmrss.exe
\ntdetec1\run.exe
\ntdetec1\shell32.exe
\ntdetec1\drivelist.txt
\ntdetec1\child\autorun.inf
\ntdetec1\child\ntdetec1.exe

So now here is the way to remove this virus.
first type following commands one by one in Command prompt and execute them by pressing enter.
taskkill /im cmrss.exe
taskkill /im ntdetec1.exe
taskkill /im shell32.exe

Now type cd\ in command prompt and hit enter.
Now type
attrib ntdetec1 -s -h -r /s /d command and hit enter. This will make the folders visible now simply Shift-Delete the above listed files. Or simple type the following code in notepad and save it with any name but with extension .bat then double click the batch file it will do the above job.

@echo off
taskkill /im cmrss.exe
taskkill /im ntdetec1.exe
taskkill /im shell32.exe

cd\
attrib ntdetec1 -s -h -r /s /d
rmdir /s /q /f ntdetec1.exe
rmdir /s /q /f shell32.exe
rmdir /s /q /f cmrss.exe
exit

Now open ur Registry by typing regedit at run and hit enter, now delete the following entry
in registry if it is present
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\ Run\"winlogon" = "C:\ntdetec1\run.exe"

No comments:

Post a Comment