What is it???它是什么？ ？ ？
AMVO.exe is a trojan/backdoor AMVO.exe是一个木马/后门
Symptoms:症状：

• Folder Option is not working - you cannot enable the Folder Option or show the hidden files running into you computer.文件夹选项不工作-你不能使文件夹选项或显示隐藏文件运行到你的计算机。
• Hidden file problem隐藏文件的问题
• Always open new windows in all drives总是打开新的窗口在所有的硬盘
• Error occur of the memory reference错误发生的范围内存

Here are the steps for removing it manually下面的步骤操作，消除手动

1. Uncheck amvo.exe from msconfig>> startup (type msconfig in run and click on the startup tab) also and restart your system取消amvo.exe从MSConfig “ ”启动（ 中输入msconfig运行，并点击启动标签）也和重新启动系统

1. Click Start > Run and type REGEDIT点击开始> “运行，并键入 Regedit
2. Go to HKEY_CURRENT_USER > SOFTWARE > Microsoft > Windows > CurrentVersion > Explorer > Advanced进入HKEY_CURRENT_USER “软件”微软“视窗” CurrentVersion “总管> ”高级
3. On the right side, double click the hidden value and give it a value of 1.在右边，双击隐藏的价值和给它一个值为1 。
4. Same for HKEY_LOCAL_MACHINE > SOFTWARE > Microsoft > Windows > CurrentVersion > Explorer > Advanced > Folder > Hidden > SHOW ALL Change the value of Checked Value to 1 .同样的HKEY_LOCAL_MACHINE “软件”微软“视窗” CurrentVersion “总管> ”高级> “文件夹”隐> “显示所有的值变更登记的价值为 1 。
5. Check if your Folder Option if its working now.检查如果您选择的文件夹 ，如果现在的工作。 If it works!如果它的作品！ OK you are now ready to delete the Amvo.exe virus now.确定你现在已经准备好删除Amvo.exe现在病毒。

… ...

Sometimes folder options in your PC may get disabled by 有时文件夹选项在你的电脑可能会停用 some virus 一些病毒 and after removing the 后消除 virus 病毒 , you can not use folder options ，您不能使用文件夹选项
here i am sharing some tricks to activate folder options again 我在这里分享一些花招来激活文件夹选项再次
Before doing this first remove that virus from ur在此之前的第一移除该病毒从我们的 computer计算机 using some good AV使用一些良好的视听
method:1 方法： 1
type “regedit” in run command and hit enter键入“注册表”的运行命令，并按输入
find any of the following keys:发现下列任何项：
User Key: HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies\ Explorer用户项： HKEY_CURRENT_USER \ Software \微软\的Windows \曲线ntVersion \政策\总管
System Key: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Policies\ Explorer系统项： HKEY_LOCAL_MACHINE \ SOFTWARE \微软\的Windows \电流entVersion \政策\总管
Value Name: NoFolderOptions数值名称： NoFolderOptions
Data Type: REG_DWORD (DWORD Value)数据类型： REG_DWORD （ DWORD值）
Value Data: 0 = show options, 1 = hide options数值数据： 0 =显示选项， 1 =隐藏选项
method:2 方法： 2
do: start > Run > Type gpedit.msc > hit enter > User Configuration > Administrative Templates > Windows Components > Windows Explorer > select Removes the Folder Options menu item from the Tools menu.这样做：开始> “运行”输入gpedit.msc “击中输入”用户配置“管理模板” Windows组件“ Windows资源管理器” >选择删除的文件夹选项菜单项从工具菜单上。 > Right click: > Properties > Disable > Apply “右击： ”属性“禁用”应用
done!!这样做！

QQRob-ABXVirus.Vbs.Small.a QQRob - ABXVirus.Vbs.Small.a

Download 下载 Perlovga Removal Tool Perlovga清除工具

Redlof is polymorphic virus that embeds itself without any attachment to every e-mail sent from the infected system. Redlof是多态病毒，嵌入本身没有任何附件每发送的电子邮件从受感染的系统。 It executes when an infected email message is viewed The HTML.Redlof.A is a very pestering virus.它执行时，受感染的电子邮件被视为该HTML.Redlof.A是一个非常打扰病毒。 From what I gather, neither does it create any loss of data nor does it send any personal information across the net.从我收集，也没有造成任何损失的数据，也没有发送任何个人信息，净。

But what it does is horrible.但是，它是可怕的。 It actually comes in the form of a script.它实际上是形式的脚本。 The script is copied onto several other .htm, .html, .vbs, .asp, .htt, .jsp files on your hard drive.脚本复制到其他几个。热媒， 。 html文件， 。欢乐， 。动态。高温热处理， 。 JSP的文件在硬盘驱动器上。 Then whenever any of these files are executed, the script is copied onto more files which create more files and so on.然后，只要有这些文件的执行，该脚本复制到更多的文件，创造更多的文件等等。

VBS/Redlof.A@m executes directly from an infected message by using a security vulnerbility in Internet Exlorer known as Microsoft VM ActiveX Control Vulnerability.欢乐/ Redlof.A @米执行直接从被感染的邮件使用安全vulnerbility在互联网Exlorer称为Microsoft VM的ActiveX控制的脆弱性。 More information about the vulnerability and a fix is available from Microsoft:欲了解更多有关的漏洞和修补程序可以从Microsoft ： http://www.microsoft.com/technet/security/bulletin/ms00-075.asp

The virus also infects files with extensions “htm”, “html”, “asp”, “php”, “jsp”, “htt” or “vbs”.该病毒还感染的扩展文件“热媒” ， “的HTML ” ， “动态” ， “ PHP的” ， “ JSP技术” ， “高温热处理”或“欢乐” 。

Redlof drops the following infected files: Redlof下降下列感染的文件：

\Program Files\Common Files\Microsoft Shared\Stationery\blank.html \ Program Files文件\共同文件\微软共享\文具\ blank.html
\Windows\System\Kernel32.dll \的Windows \系统\ Kernel32.dll中
\Windows\web\kjwall.gif \的Windows \网络\ kjwall.gif
\Windows\system32\desktop.ini \的Windows \ system32 \的Desktop.ini

“blank.html” is used to replace the default stationaries for both Outlook and Outlook Express via registry causing that… “ blank.html ”是用来取代默认stationaries为Outlook和Outlook Express通过注册表造成的...

( Also known as: Virtumonde, Msevents,and Vundo, Trojan.vundo ) （也称为： Virtumonde ， Msevents ，并Vundo ， Trojan.vundo ）

… ...

My friend had a problem with his computer.我的朋友有问题的电脑。 He was getting the following message when opening Orkut:他得到以下消息时，开放的Orkut ：

ORKUT IS BANNED,Orkut is banned you fool`,The administrators didnt write this program guess who did??`r`r                                               MUHAHAHA!! Orkut是禁止， Orkut是禁止你傻瓜' ，管理员didn't写这个程序猜谁呢？ ？ ` r ` r MUHAHAHA ！

On further research I found out that this is caused by a worm called win32.USBworm.在进一步的研究，我发现，这是造成的蠕虫病毒称为win32.USBworm 。 It also blocks Firefox from accessing the internet.它还区块的Firefox访问互联网。 The following message comes when opening Firefox:下列讯息际开放的Firefox ：

I Dnt Hate Mozilla But Use IE Or Else… with title as Use Internet Explorer U Dope.余二硝基甲苯Mozilla的仇恨，但使用IE浏览器，否则...与标题使用Internet Explorer ü涂料。

And it also blocks Youtube popping up the following message:它也区块视频弹出以下信息：

youtube IS BANNED,Orkut is banned you fool`,The administrators didnt write this program guess who did??`r`r                                               MUHAHAHA!! YouTube是禁止， Orkut是禁止你傻瓜' ，管理员didn't写这个程序猜谁呢？ ？ ` r ` r MUHAHAHA ！

Follow the steps below to remove this worm from the infected machine:按照以下步骤删除此蠕虫病毒从被感染的机器：

1. Open Task Manager –> Processes –> Find svchost.exe under the user account (There will be others under network and system accounts. Don’t close them).打开任务管理器-> “过程- >”查找sv chost.exe根据用户帐户（将根据其他国家的网络和系统帐户。不要关闭）。 There will be two svchost.exe under the user account.将有两个svchost.exe下的用户帐户。 Kill both of them.杀死两人。
2. Then go to Start –> Run –> regedit and find the following key:然后去开始“ ->运行- >”注册表，找到以下项：
   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run HKEY_LOCAL_MACHINE \软件\微软\的Windows \ CurrentVersion \政策\总管\运行
   Delete Winlogon key from删除从Winlogon关键

… ...