How to Remove RavMonLog Virus

In this post, I'm not going to insert any pictures or images. It has been a while since this problem occured. I've tried a number of those free anti-viruses (I'm stingy okay..hehe) and none of them work. I tried using a Ravmon Removal Tool (right click and save as here to download) but it didn't cure my problem. I haven't try the new version called the Smart Anti Virus 1.0 but I'm going to check it out soon.

Anyway, one of my colleague here at my office circulated an e-mail on how to remove RavMonLog virus. I've tried it myself, and it works:

THREAT NAME
Worm.RJump.A

CLEAN INSTRUCTIONS

1. Right click on an empty space from the taskbar (or right click on the clock from the right corner) and select Task Manager.
   - Select the Processes tab, locate ravmon.exe, right click on it and select End Process
   - Delete the following file: C:\Windows\ravmon.exe


2. To clean the removable storage device (USB stick, PEN drive etc.) right-click on your USB stick / PEN drive icon and select Explore.NB: Be careful NOT to double-click the icon because the malware will be reactivated.
   - Locate and delete the autorun.inf and ravmon.exe files


3. Click on Start, Run, type regedit and click on OK.

NB: Before you edit the registry, please export the keys that you plan to edit, or create a backup of the system before you proceed.

1. Navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run


2. Delete the "RavAV" = "C:\windows\ravmon.exe"

SYMPTOMS

1. Presence of the autorun.inf and ravmon.exe files in the root of the storage device.


2. Presence of a copy of the ravmon.exe file in the windows system folder.


3. Presence of the RavMonLog file that contains the port number for the backdoor component.
   
   

DESCRIPTION

1. Worm.RJump.A spreads by creating a copy on removable storage devices or mapped drives.


2. It drops the following malicious files:
   
   
   
   • autorun.inf
   
   
   • ravmon.exe
   
   
   
   


3. Also it drops a clean msvcr71.dll file that is a part of Microsoft Visual Studio.


4. It opens a port for the backdoor component.