removing ravmon virus without anti-virus is easy,
but if you want anti virus suggestion or quick and easy way to remove this virus download Trend Micro AntiVirus plus AntiSpyware
virus they can stop your pc from being infected but once you are infected they wont be able to remove it.
I dont know the actual name of this virus nor its effects
Anyways its very easy to remove it
you will have to follow just few simple steps.
- check if ur infected
- stop currently running virus
- delete virus files
- remove virus to run from startup
so here are the following steps explained
remember until you delete the virus files please open drives using address bar by typing C:\ D:\ X:\ as the virus is activated if you double click the drive
1. Right click any drive on your computer and see if right click menu shows some invalild characters
like this
If yes then you are infected.
2. Press Alt+Ctrl+Del to bring up the task manager (or right click taskbar to run it)
there will be a program in processes named “SVCHOST.EXE” there will be few svchost in small case but check one in capital letters, if you see more than one “SVCHOST.EXE” (all caps one) end the one with your username infront of it instead of LOCAL SERVICE, NETWORK SERVICE or SYSTEM.
by pressing end process
3. to delete the virus files you need to show system protected files.
for this goto
My Computer->(Menu) Tools-> Folder Options -> (Tab) View -> uncheck “Hide System protected files” -> press OK
If you are unable to unhide the system files you can use 3rd party softwares to browse drive and delete files, try ACDsee or WinRAR
Now open drive (by typing drive letter in address bar)
delete these 2 files
- Autorun.inf
- Ravmon.exe
also delete those in all drives (not CD(WR) or DVD(WR) drives) (and remember don’t double click else you will have to start over from top)
Open Windows folder and delete SVCHOST.EXE, SVCHOST.dll and MDM.EXE
Now restart the explorer.exe process by killing it in taskmanager and runing it again [(winkey + R), type "explorer" and hit enter]
now right click the drive letter and ull see a clean menu
congrats virus is removed
4. Now remove it from startup (Optional as files are deleted)
Winkey + R type “msconfig” hit enter
goto startup tab-> (uncheck) MDM -> OK -> Exit without Restart
How to prevent from this virus in feature
just right click any USB drive (that includes iPod) you have plugged into your PC
if they have currpoted menu the drive is infected
Access drive by typing drive letter and delete files from that drive
Remember you double click the curropted drive you get infected else ur safe
The End
its nice thats very good to help others
EMiN3M your procedure is good but you have done a mistake you do not know that When we a windows system is infected with virus we can open folder options but the options “Show Hidden files and folders” and “Hide System protected files” will not be working anymore.
Thanks Abdullah, as it was working for me so i didn’t notice that this could also be a scenario,
btw you can use 3rd party softwares like winRAR and acdsee to browse drives and delete files
*iev edited post*
thnku so much…….iv been looking all over the place for a solution and this one actually worked…..thumbs up to u!
btw any guidelines on how to disinfect Flash drives/portable drives
same procedure for flash drives
delete these 2 files
* Autorun.inf
* Ravmon.exe
remember dont double click the drive if its infected
yeah sort of figured that out… thnx
btw could u guide on how to hack email accounts? just asking ……..
its nearly impossible to hack email accounts
you can only trick user and get his/her password
and no i don’t have such guides
Hi All,
Nice guide, but in some cases i have seen that user is unable to use Task Manger, Regedit, Run, or Folder Options, for these kind of cases, Use Process Explorer to kill the Process and follow the guide. But for complete recovery this guide is not sufficent…
thxs yaar zabardast
jo kaha wo kara tum nay
per yaar data hide ha ab bhi us k lie bhi reply me
ok another query..for some unknown reason recently whenever I open a word document it creates like 2-3 hidden word files with strange names the folder its saved in………..while using the original file i cant delete the hidden files but after closing the main document i can delete or remove the hidden files and the original one remains intact …..is it a virus or something? …………..Iv got AVG 7.5 installed on my PC yet dont know y it dosent detect it…..any help?
Peppy thanks for the question please check this post
http://fkn1337.com/weird-hidden-word-document/
u know wat your coming up with answers is going to keep on prompting me to ask more…hope its not a trouble…anyways thnku
i would love to have more interesting questions
AOA
Thats really bad virus. i ve seen this virus in the systems of all my friends and relatives and i also removed it. It somtimes does not allow users to open taskmanager and/or registry editor. To remove it goto Start Menu and click on run and enter gpedit.msc and find somthing like Taskmanager and change its value to enabled. Then kill all the tasks which you think are not daily tasks… e.g; RavMon.exe,New Folder.exe,Kill,blah blah… then remove the registry enteries from the registry editor to stop running this worm at startup or simply goto Start Menu and click on Run and type in msconfig and press enter the Goto Startup Tab and uncheck all the items and then restart pc…
Sorry i dont have enough time to write more..
Visit my website for more instructions:http://tz.t35.com
TC
ok..im back with more questions
1)I keep on reading on the web that other anti viruses like Kaspersky are far better than Symantec…..true? coz i asked someone and they said using commonly known antiviruses is easier ….secondly does the symantec antivirus corporate edition v10.2 cover email Pop3 scanning coz ive gone thru its features and it dosent mention a thing on email scanning….last but not least (a friend’s query) can anyone guide on how to import excel .dbf files into FA-127 software that comes with CASIO digital diaries … as u can export .dbf files from FA-127 software but while importing it just wont accept any type of xl file even .dbf types?????????
thank you soo very much…
i’ve got it out of my system…
thanks alot…
cheersss…
your a legend, there is heaps of outdated #### about this infection on the web, this info (above) is the only good source to remove it
Thnx Buddy…u saved my audio n video collection of 200GB…if u need ne kinda help plz knock me…i’ll b alwz @ ur service…tk cr n best of luck for ur bright future
am not actually sure about pop scan support in Symantec but i do know that Symantec anti virus sucks, i have had debate on whats best anti-virus and ended up using none but so far best are AVG and Kaspersky, i recommend AVG if you are having a low gigz processor.
About the diary FA-127 seems to be an old model of casio.
and no open source or any software other than casio’s original which doesn’t seems to work fine for you, just check if you are using latest version of software
FA-127 driver ver 3.0 and FA-127 driver ver 1.5 give those a try
on the other hand there are various .dbf to .xls and .xls to .dbf converters try googling “xls to dbf“, i hope you get what you are looking for.
Thanks for the comments guys
I done dis long time before but did not post it …. anyway thanks for the post …. It will help others ….
Hi im having problems with my flash disk that has ravmon.exe and its autorun, ive deleted them numerous times but after a few seconds they come back, i formatted my flash disk but its still there, i used some ravmon removal tools but it aint working coz it keeps coming back .. word? thanks THE CHINESE FREAKIN LETTERS are still in my flash drive wen RYT clik
dear so thanks
i will be very thankful tu u
@Michael please follow the tutorial, you will be fine
thank u very much i searced all the web for this page
realy thanks
Hi
Nice documentation, We were a victim of this virus, and spent hours trying to get rid of it. Unfortunatly there was no sign of the Ravmon.exe file but only the autorun.inf on the disks. One other thing that virus does is to propagate and infect lots file with Trojanback on the disk and I would suggest you run Spybot seach and destroy untill it passes clean and then run AVG until it passes clean.
Also this virus will also disable access to the CMD line by changing the user rights to Admin only and get Spybot seach and destroy to autorun directly after a reboot to stop it.
I also found a helpful place help to rid this virus as well
http://technodigits.wordpress.com/2007/06/06/ravmon-virus-killer/
\ DB
thanks for sharing this information with us. I search all those files one by one mentioned in your post and deleted them accordingly (search for hidden files and delete only those hidden files). when i run msconfig, mine was an blank thing, without any descriptions, so i uncheck that and restart comp. it works fine. next time i will remember to check my portable drive first before double clicking anything.
btw, do you know how this virus come by?
Hi.
You r too good man.. i have been searching over the net for nearly 3 days and finally i saw this page…
Thanks a lot man,,,,
One small thing i have removed the virus from my hard drive using the procedure…
But whenever i connnect my external harddisk those freaking chinese letters come in the right click menu…(only of the external hard drive)
but there are no hidden files like ravmon.exe and autorun.inf file in that harddisk..
Please tell me a way to remove it… ( although nov my system and external hard disk is free of viruses)
Please help..
Thanks in advance
Kapil
@Kapil, just restart your PC and see if it still shows, cz that menu is cached.
thats good,,virus r removed,,but show hidden files and folders r not working…
I lost the general tab in my internet options, how do I get it …
@JAAN
try this Internet Options under Tools on Internet Explorer is changed and the General Tab is no longer present
I couldn’t understand some parts of this article e RavMon.exe virus without any anti-virus at Fkn 1337, but I guess I just need to check some more resources regarding this, because it sounds interesting.
great men!!
tks brother
regards from lisbon
Nl
AS-SALAM O ALIKUM…hey people m havin a problem with opening any drives of my system by simply double clickin…i go through the above procedure but i neither hav SVCHOST in task manager nor in windows folder….n not even MDM so plz can u help me out…thanx
AS SALAM O ALIKUM
hey i cant open up my drives by double clickin….i opened it wid RAR but i cant find any ravmon.exe or any suspecious file…n neither do i c any wiered letter whn i right click on my drive folder…plz help me out…thanx
hi
before i work ur shown way the virus has disabled the folder option and search option. can u suggest me something?
Im using Window XP. Im not able to open my c: drive. when i click on it the it gives me another window which says OPEN WITH. More over i am Not able to Unhide the files.
Pls. help
Thanks
thanks a lot
thanks dear its working i greatly thanks fulll to you for this
cherrrssssssss
Please game the main files of this virus executable virus if i fine the main files please me ok
whats is the origenal files or main source of this executable virus
good work bro.. but i have a problem, when my system was infected with that RavMon virus, firstly i try to update my symantec but i can’t therefore i format my windows partition & trying to reinstall windows, as the virus present in my important partiton & i can’t format it so that infected partition didn’t allow me to install windows xp on fresh partition.. i gives different error messages during setup & it fails.. so now i have to install windows98 the virus is removed now but still i can’t install winxp.. & my drive still shows that invalid characters & i couldn’t open my drive directly by double-clicking as it shows a error “RavMon.exe is not found.. a file required to open the file type is not present” please tell me anyway to get rid of it..
Thanks a lot its worked fine for me !
Most of the files were already removed from my Antivirus i was ti just delete those Autoruns !
Thanks a lot !
pz tell me how i can download it
Thanx dude
it worked
Thanks. You’re a PC saver!
I searched and searched and all the anti-virus websites had these amazingly complex procedures. You’re method was extremely easy and effective. Thanks for the dedication.
You are officially a genius!! This problem’s been bugging me for ages…
Just wondering if you know anything about this…
When i startup my computer I get the windows welcome page, login and then one of 3 things happens..
1. The computer shows a blue screen with about half a page of white writing on for less than a second and then reboots
2. Everything loads as normal, but then the whole screen freezes and I have to force the computer to turn off at the mains.
3. It starts normally, but displays ‘Your computer has recovered from a serious error’ and a window headed ‘Associated Application Not Found’ which says ‘The WiseUpdate client could not locate an associated application to update. Please make sure that this software is installed properly.’ but this usually only happens after a few times witnessing 1 and 2.
Any ideas muchly appreciated, especially based on your extremely competent advice above.
Thanks,
Tom
Hey…Spc B here in Iraq… I have abour 20 people here with this virus… trust me .. if this work like i hope… we will all thank you!
@Tom
thanks Tom,
this can be due to several reasons
but try updating your display drivers and unplug ram and plug it in other slot swap if slots are full.
gimme more details about OS motherboard and graphics card
Very Good manual Guide-line for killing
Ravmon.exe and its links.
hey, mine is in small letters. how is that? i don’t get it. pls help me. can i just follow your guide?
Thanks for sharing this information with us.
But I’m infected by this virus in different way.
My pc start normally but after displaying desktop it halt my computer or slow down as I can not remove these file or do any work.
Any ideas appreciated, especially based on your extremely competent advice above.
Thanks,
Sadiq Ali
Sadiq try loggin in safe mode by pressing F8 before windows bootup screen
slowing down or hanging is not caused by ravmon i think
Hi,
I ahv a problem tht by pressing Alt+Ctrl+Del a message appears on screen “An application is disabled by administrator” and also folder options are not coming on tools menu.
What to do man?
Please help…………
Thanks in advance.
I tried but window doesn’t load in safe.
Thank you dear friend.. It did helped me alot to get out of this ****ing virus..
thank you
gytu
thank you bro, it helped us to kill this virus.
A tremendous discovery from u EMINEM but !!!!!!!!!…………………….one thing that makes me SAD
is that, no doubt we are successful in removing that VIRUS but along with that it made a usful feature of windows useless……….. n thats FILE HIDING OPTION in in which we are unable to unhide our files and folders, infact we are able to unhide those files and folders by a third party software but this doesnt makes any sense because that virus did it’s work by disabling a feature of WINDWOWS.
I was also being suffered a lot from this virus.
But after a long search i got the solution and that was a removal tool [RAVMON REMOVAL TOOL].
We have to just download that tool from http://www.mediafire.com and download it to our system.Further we have to run that tool by double clicking on the tool’s icon.
We will get the message, remove RAVMON from HARD DRIVE,USB etc.
Simply remove it and we will enjoy the benefits of our computer.
Do not worry about that fucks… I have made a software for that fucks. The problem is that you can not open any drive with dobule cilck and these files add some unknown language to your hard drive menu. so do not worry… farimarwat is still alive for you problem solutions… download my softw for free and scan your all drives, reboot your system for best result and get rid or RavMon.exe
http://www.geocities.com/farimarwat/setup.zip
farimarwat
pakistan
Some friends says that it do not start to download please right click on link and then “save target as”
This tool is only to burn for RavMon.exe with out any work hard
The name of this soft is Fari Auto Play Burner 2007
I am giving the link again http://www.geocities.com/farimarwat/setup.zip
soory but no one can kill ravmon because of the fucking windows and it’s registry. your Pc in not really yours ravmon is there forever
There is also orignal RavMon.exe of MicroSoft but my tool will only remove the fake RavMon.exe and AutoRun.inf
what is the procedure that the folder option work properly and 100% unhide all hidden files after removing Ravmon.xex and autoren.inf(149b).
plzzzzzz
inform me and send information at
shah_datcom@yahoo.com
shahnawaz_255106@yahoo.com
hey people m havin a problem with opening any drives of my system by simply double clickin…i go through the above procedure but i neither hav SVCHOST in task manager nor in windows folder….n not even MDM so plz can u help me out…thanx
before i work ur shown way the virus has disabled the folder option and search option. can u suggest me something?
I ahv a problem tht by pressing Alt Ctrl Del a message appears on screen “An application is disabled by administrator” and also folder options are not coming on tools menu.
What to do man?
Please help…………
what is the meaning of Process Explorer to kill the Process
please help me
am bac n wid more problems….lolz…….now this one has nothing to do with Ravmon but am stil pasting it here coz well i like dis page…now the prob is dis dat i have a small LAN of abt four pcs ..i hav AD installed on win 2000 server ..all oder pcs have win 2000 pro..recently I bought a new labtop dat has win XP preinstalled..I’m trying to connect it to the LAN ..I can use the internet but I cannot join the domain…it gives the following error:
[The following error occurred when DNS was queried for the service location (SRV) resource record used to locate a domain controller for domain IC.COM:
The error was: "DNS name does not exist."
(error code 0x0000232B RCODE_NAME_ERROR)
The query was for the SRV record for _ldap._tcp.dc._msdcs.IC.COM
Common causes of this error include the following:
- The DNS SRV record is not registered in DNS.
- One or more of the following zones do not include delegation to its child zone:
IC.COM
COM
. (the root zone)
For information about correcting this problem, click Help.]
Can u plz provide a solution ????????
@pramod
its “new folder” virus not ravmon
@pam
alt ctrl del (task manager)
@peppy
try using custom dns
enter this
208.67.222.222
208.67.220.220
in primary and secondary DNS settings (in network card properties -> TCPIP4 settings)
for more info on this DNS check opendns.com
nope dosent work…………
love u thanks a lot u make me proud in front of my younger brother.
You can download my soft for this problem. It completly remove the RavMon.exe and AutoRun.inf. The link is http://www.geocities.com/farimarwat/setup.zip Right click on the link and then click “Save target as”, your download will be started.
if you have again any problem then email me. farimarwat@hotmail.com
Fari Marwat
hi,
if you need any kind of help..
ask me on my website http://tz.t35.com/mboard
i’ll be very happy to help you thanks!!!
well…mine problem seems different though its infected with Ravmon.exe…
in my task manager- processes, there are 6 SVCHOST.EXE…all in caps, no svchost.exe in small letter…and all these processes have got either SYSTEM, LOCAL PROCESS, or NETWORK SERVICE in front of it..there is no svchost.exe with my username in the task manager…
u think its possible?
wutever, its happening in my system
cud u help me out dude?
@Ashish
i dont think its running then
just end all SVCHOST as you can some of them will appear back but no problem
and continue other steps to remove ravmon
Hi. Can I ask your help my laptop has been infected w/ W31.Imauy.AY and it disable the task manager ang regedit and it closes the other programs when I open it. after When after I enable the task manager ang regedit everytime I open it stay for only a few seconds then it closes automatically. Because of the problem i encountered I can’t stop the process of SSCVIHOST.EXE in the task manager. Hope the you could help me w/ my problem. Thnks and God Bless….
Thanks for such a nice help, i recovered my system from that virus successfully.
EMiN3M your procedure is good but you have done a mistake you do not know that When we a windows system is infected with virus we can open folder options but the options “Show Hidden files and folders” and “Hide System protected files” will not be working anymore.thanks
Brilliant solution and thanks for the step by step process. It is much appreciated. Thanks a lot.
thanks dude , very nice tut.
Thanks so much!!!!
this is the best help in the www for this ravmon shit. thanks !! greetz from germany!
Hey dude thanx a million, we upto our necks in this b.s, but i still cant unhide my files, any solution to that?
@EMiN3M
i managed to get rid of this virus manually but my “show hidden files and folder function” is not working.
plz help me with this problem.
SVCHOST.INI NOT SVCHOST.DLL, but thanks anyway, works like MAGIC!
Hi friends…I am back with update..
I have updated my tool to remove the ravmon.exe completly from your all drives….
http://www.geocities.com/farimarwat/setup.zip
copy the link and paste it into your browser addressbar
If you find any problem then email me.
fari marwat
farimarwat@hotmail.com
thanx for the help…. very appreciated!!! im from malaysia….
Thanks so much, Eminem!! Your solution is still the only one that helped me. Your help and clear steps are much appreciated. You saved my day!
@all
anybody know about the new virus which crushes the file system of the pen drive to RAW file system and make it useless…. ?
is there any remedy for this damage ? plz help me with this thanks…
Hi I followed all the instrustion that u told one thing i could find is that the svchost.dll file was not there rest of the things I did now the files RavMon.exe and autorun.inf files are not there in any of the drives but still i\’m not able to see the hidden files… its sill the same case….
Please help me… Is there anything else that i should do?
just thanks mate !!!!
Salam again….
Now I amagain with updates..
Evil Eyes Tool::::
I have made a tool for New Folder.exe and a worm that creat exe file with the name of same folder. It also remove Indonasion Smile virus. It with bring back your all folder option problems..
Go to the site and download New Folder.exe removel tool for free
http://www.marwattimes.netfirms.com
I have also updated Fari Burner 2007 to F.B.I 2008
It remove all kind of worms that creats drive opening problems.
farimarwat
anybody know about the new virus which crushes the file system of the pen drive to RAW file system and make it useless
Thank you for your simple and fast solution
Nice one!
thanks
download autorun.inf virus tools
perpose fo flash drive
am not actually sure about pop scan support in Symantec but i do know that Symantec anti virus sucks, i have had debate on whats best anti-virus and ended up using none but so far best are AVG and Kaspersky, i recommend AVG if you are having a low gigz processor.
About the diary FA-127 seems to be an old model of casio.
and no open source or any software other than casio’s original which doesn’t seems to work fine for you, just check if you are using latest version of software
FA-127 driver ver 3.0 and FA-127 driver ver 1.5 give those a try
on the other hand there are various .dbf to .xls and .xls to .dbf converters try googling “xls to dbf“, i hope you get what you are looking for.
Salam:
For those who have having problem of not showing Hidden Files.Simply Follow the Following steps to unable the \’Show Hidden Files Options\’ ….
* Open registry( select run command from start menu and type regedit and then press enter)
* In the left pane goto path HKEY_LOCAL_MACHINESoftware\\Microsoft \\Windows \\CurrentVersion \\Explorer \\Advanced \\Folder \\Hidden \\SHOWALL
* Delete the value CheckedValue in the Right pane by right clicking it and selecting delete. (Its type should be REG_SZ and data should be 2.)
* Create a new DWORD value called CheckedValue by right clicking in the Right pane and then selecting new -> DWORD Value and then changing the name to CheckedValue. (same as above, except that the type is REG_DWORD). Modify the value data to 1 (0×00000001) by right clicking the CheckedValue in the Right pane and selecting modify and changing the value data to 1.
This should let you change the “Hidden Files and Folders” option.
HAVE FUN
I found ravmon.exe on my usb stick after visiting a webcafe. This doesn\\\’t bother me at all because I am running Ubuntu Linux, but I find it very difficult to believe that there are still idiots out there who use Windows. My solution for removing this virus is as follows:
1. – Download Ubuntu from ubuntu.com (or any other linux distribution that suits your needs)
2. – Wipe your hard drive and install the Linux operating system.
3. – Enjoy a system that is infinitely more secure and stable than the scam that is MS Windows and has far more software available, easier to install and is as good if not better than what you have to pay for or get illegal cracked versions with windows.
Alternative solution:
1. – Get a mac.
Hope this helps ! Alex.
I have problem with hidden files when i checked the radio button on show all hidden files uncheck the superhidden files it automatically checked the radio button on don\\\’t show the hidden file. I already use third party software but it won\\\’t work even i changed there still it don\\\’t show the hidden file.eventhough i have killed all the virus from taskmgr and msconfig the hidden files were not shown.plz help me to show all the hidden files.
but sir my taskmanager is disabled?
thanks…………this is very usefull……………
RavMond.exe how find and deleat this. also i have genuaine window activation patch.
pl tell me my freind to how can i solve to deleat this genuaine window activation patch.
shahidfurqan2003@yahoo.com