Olhrwef.exe/tavo.exe/m1rqygb.exe Removal


o Kaspersky - Trojan-GameThief.Win32.Magania.cgsz
o McAfee - Generic PWS.ak
o Ikarus - Worm.Win32.Taterf

This was detected as a Worm, which also comprises of the characteristics of a Trojan. It has become quite famous among the list of viruses these days. However, the damage caused by the Worm to the system is less when compared to the new ones. Once the Worm is executed, it launches its process during which a number of copies of the Worm are created in all the drives of the computer. An autorun.inf is supplemented to each of these drives which executes the copies once the drive is double-clicked by the user. Registry modification is done such that the file is launched at every startup either as a separate process or as a service. At the next boot, the virus attempts to connect to a remote site from which malicious programs are downloaded by it and later executed. It also modifies the "Show hidden files" option from the registry, thus preventing the option from functioning when the user tries to view these files. The files associated with this Worm can run in just about all the platforms of Windows operating systems. There is a possibility of the worm getting updated later on. So better act fast if you don't want it to download more programs. It must be deleted as early as possible to avoid further problems. Follow the instructions below to delete it.

Manual instructions to delete olhrwef.exe/tavo.exe:

  1. Begin by restarting the system in Safe Mode. During this type of boot up, the Worm cannot launch its own processes and thus it becomes easier to delete the virus. Click here if you're having trouble booting in the Safe Mode. Don't open any of your drives throughout this process. If you do, the autorun.inf present in the drive may open the Worm and you'll have to start all over again.
  2. Lets begin by reversing all the changes made by the Worm to the registry. Go to Start --> Run and type regedit to open the Registry Editor. Delete the following entries from the Registry
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\AVPsys
and
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AVPsys
Now, navigate to these locations and delete the values
HKEY_CURRENT_USER\S-1-(Varies)\Software\Microsoft\Windows\CurrentVersion\Run\
Here, delete the value
“cdoosoft” = " %Windir%\system32\olhrwef.exe"
Also delete any value consisting of the names "tavo.exe", "cc.exe", "ff.exe" or "m1rqygb.exe". As mentioned earlier, the Worm also modifies the Registry to stop your Show hidden files option from working. Follow this link to get it working again.
  1. Restart your system again in the Safe Mode. Since there are too many files to delete, it'd be a very long process to go to the various folders and then delete them. So here's a simpler way. Open Search from your Start menu and search for these keywords separately. Don't forget to set it to "search hidden" before you hit the search button.
    • Autorun.inf (Delete all the autorun files found)
    • olhrwef.exe
    • m1rqygb.exe
    • nmdfgds0.dll
    • nmdfgds1.dll
    • AVPsys
    • tavo0.dll
    • klif.sys
    • tavo.exe
Sometimes you may find it difficult to delete these dlls. If this happens, you'll have to unregister them. See this for help on doing it. I know there are too many files to delete but hey going through this is faster and definitely easier than formatting your system!
  1. After this, reboot once again and go to Start --> Run and type %temp%. You'll see a folder that shows you all the temporary files. Make sure you delete all of them(including the hidden files).
  2. Once you've done that, you're done with the virus. Also refer the links below for more assistance such as an alternative to searching and deleting it which can also be done through Command Prompt. Deleting this Worm from the disk drives is similar to deleting a virus from the Removable drives. So see this if you'd like to try out the Command Prompt instead.


Posts that might help you here:
Enabling Safe Mode booting, Enabling the Registry , Enable Hidden files and folders option and Enabling the Command Prompt.

Installing a good anti-virus may also help. Here are the recommended anti-viruses to get rid of the worm for sure:

Eset Smart Security V.4.0

McAfee Total Protection 2011

Kaspersky Internet Security 2011 1-User
VShop
Get the best security software for your compter here!

powered by Blogger | WordPress by Newwpthemes | Converted by BloggerTheme