How to Removed AVPO.EXE Spyware

I caught this from my portable drive when I am doing servicing in my customers office. Seems like this one is quite annoying and even some anti-virus unable to detect it. Luckily my AOL free Kaspersky was able to catch this nasty things without any problem and also using MAVW for the clean up. Anyway, worth checking out the news below and how to removed manually.

Jamboforum - AVPO.EXE is a file recently detected by several antivirus databases. This file is yet to be determined globally as Good or Bad, therefore it is currently classified as Unknown. However if it is malware then it may well be caught by the behaviour protection in databases.

The only way to safeguard against this possible threat is by installing an antivirus (Kaspersky) which has the ability to protect you from all bad files from the instant they are determined.

DEFINITION OF AVPO.EXE
Safety Rating: Uncertain
First seen: Aug 19 2007 (GMT)
Last seen: Aug 19 2007 (GMT)
File Size: 68,727 bytes

How to Manually removed

Thanks to zobl0g.com - Run your windows from Safemode: Press (F8) before your windows startup choose Safemode, then the next step:

Step 1:

1. Open up Task Manager (Ctrl-Alt-Del)
2. If wscript.exe is running, end it.
3. If explorer.exe is running, end it.
4. Open up “File | New Task (Run)” in the Task manager
5. Run cmd
6. Run the following command on all your drives by replacing c:\ with other drives in turn (note: if you have autorun.inf files that you think you need to backup, do so now): del c:\autorun.* /f /a /s /q
7. Go to your Windows\System32 directory by typing cd c:\windows\system32
8. Type dir /a avp*.*
9. If you see any files names avp0.dll or avpo.exe or avp0.exe, use the following commands to delete each of them: attrib -r -s -h avpo.exe and then del avpo.exe
10. Use the Task Manager’s Run command to fire up regedit
11. Navigate to HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run (as usual, take a backup of your registry before touching it!)
12. If there are any entries for avpo.exe, delete them.
13. Do a complete search of your registry for ntde1ect.com and delete any entries you find.
14. Restart your computer.

Step 2

1. Open up registry editor, search and delete all registry keys containing any of the following: avpo.exe and ntde1ect.com2. Restart your computer and boot off a windows XP bootable CD
2. Choose the repair option at the initial screen
3. Choose your installation and enter administrator password to log in to command console
4. Type in the following commandscd \windows\system32, attrib -r -h -s avp*.*, del avp*.*, attrib -r -h -s c:\autorun.inf, del c:\autorun.inf, attrib -r -h -s ntde1ect.com (take note of the “1″ instead of “t” ), del ntde1ect.com
5. Restart your computer after this