This is an awful virus, don’t know who infected it. It spreads via USB Memory Sticks. It can not be seen in the process list, hides itself and hides all files. The antivirus programs doesn’t see it.

Virus Signs

1) You don’t open system drivers
2) If you can see amvo.exe where msconfig(start/run-cmd).
3) You don’t connect directly memory cards.
4) You can not show hidden files and folders.
5) Slows down USB devices.
6) Drives open in new windows from My Computer.

That is a response. You dowload and run this program(ComboFix).
Download Now

Anything more ?

Sysprep(The System Preparation) is a tool designed for corporate system administrators, OEMs, and others who need to deploy the Windows® XP operating system on multiple computers. After performing the initial setup steps on a single system, you can run Sysprep to prepare the sample computer for cloning.

Sysprep assigns a unique security ID (SID) to each destination computer the first time the computer is restarted. Sysprep configures the operating system to use Windows Welcome or Mini–Setup to run the first time the end user restarts the computer. This shortened form of GUI–mode Setup takes 5 - 6 minutes instead of the usual 45 to 60 minutes, and it prompts the end user only for required and user–specific information, such as accepting the End–User License Agreement and entering the Product Key, user name, and company name.

Sysprep is a valuable utility even if you do not use disk duplication. You can run Sysprep with the –nosidgen switch to configure Windows Welcome or Mini–Setup on a single computer. In this case, Sysprep allows for auditing that may have been done; automates the Mini–Setup portion of the process so that users can still enter user–specific information, such as regional options and TAPI information; and bypasses setting up unique SIDs, because the SIDs will already be unique when Setup is actually run on the computer.

Configured a Reference Computer

• Install Windows XP Professional with sp2

Windows Xp Professional with Sp2 installed.

Change the way user log on or off options to control panel.

• Start / Control Panel / User Accounts / Change the way user log on or off
• You disable all options this screen

And log off then log on administrator account.

You will want to preserve any custom user settings on the reference computer before creating an image.

After the image is deployed on a target computer, the custom settings will apply only to users who log on to the target computer as the administrator. To make the custom settings avaible to anyone who uses the image, you will need to copy the administrator profile to the default user profile before creating image.

On the reference computer, create a new account that has administative privileges, and than log on by using that account. Because when we are copying administrator account is not in use.

Then log off administrator account, and log on Mark Jone ( Administrative privileges account )

You must be show hidden files and folders.

Same folder window’s top menu, click “Tools” menu. And press the “Folder Options” button in the tools menu. In the folder options window, click “View” tab. And select “Show hidden files and folders”.

We will copy to administrator profile to the default user profile this step.

Start / right-click My Computer / Properties / Advanced tab / in the User Profile section / Settings

Select “REFPC\Administrator” and then click to “Copy To” button.

In the Copy To dialog box, Local Disk C ( System Drive )\ Documents and Settings\Default User

And click Ok.

Click the change button.

In the “Select or User Group” dialog box, type “Everyone” in the name box, and click OK

A “Confirm Copy” message box appears that states, click YES and then click OK until all dialog boxes are closed.

We finished to the administrator profile copy to the default profile.

Then log off Mark Jone account, and log on administrator account.

On the administrator account, you can delete other accounts, because we dont log on other accounts.

Right-clik My Computer / Manage / Local Users and Groups / Users /

Select Mark Jone right-click and press the delete button.

Local Users and Groups dialog box appears that states, click YES.

However some accounts folder didint delete in the “Documents and Settings”. You can delete this accounts here.

Create a new folder in the “Local Disk C ( System Folder )” and rename this folder “SYSPREP”.

Insert the Windows Xp Professional Cd to the Cd-Room.

Right-click Cd Drive / Open / Support / Tools

Open Deploy.Cab.

Copy “Setupcl and sysprep” files to /system_drive/SYSPREP folder.

We will create an answer file.

Open “deploy.cab” and copy “setupmgr” files to desktop.

Click “setupmgr” on desktop. And complate this wizard following steps. But some of this steps is important.

You select “Sysprep Setup” / “Windows XP Professional” / “Yes full automate the installation”.

Dont create an administrator password.

Then you complate other steps. At the end of the wizard, save “sysprep.inf” to the “/system_drive/SYSPREP” folder.

Finished answer file.

After you configure the referance computer, you must use the System Preparation tool, Sysprep.exe, to remove all information that is unique to the reference computer, such as the security identifier and computer name. By removing this information, you can prevent security problems that could arise if two computers have the same SIDs.

We will reseal the Windows Xp Professional.

Open “/system_drive/SYSPREP” folder. Click “sysprep.exe”.

“System Preparation Tool” dialog box appears. Click OK. And then appears that state “System Preparation Tool 2.0” window.

We will use “Mini-Setup”, so you must select “Mini-Setup” and “Detect non-plug and play hardware” options. Then click “Reseal”. And then appears one dialog box, you click OK.

After the reference computer shuts down and is ready to be imaged.

Important: Dont open this system.

Finished sysprep.

We will imaged to be referance computer. We will use Acronis True image program.

Insert “acronis true image boot cd” to the cd-room. Start the referance computer. Insert bios. Setup boot cd-drive.

The reference computer boot the acronis true image cd. Select “Acronis True Image Enterprise Server(Full Version).

First, we will backup image to reference computer.

And following steps, next.

If you have a usb harddisk or dvd-wr, you can use it. But i prefer local network. I create a folder another computer in workgroup and I share this folder. I will use this folder for backup.

And following steps, next. At the end of the stpes. Click Proced.

Finished backup operation.

We prepared new backup file. You can use it for new installations.

How can ı use this backup image ?

You must insert the “Acronis Boot Cd” to Cd-Room and start new computer from Cd-Room.

Select “Recovery”. And following that steps. At the end of the stpes your backup image installed new computer. Restart computer. Eject the “Acronis Boot Cd”. And this system start normaly but perform mini-setup.