All variants of kxvo.exe

• Downloader [Symantec]
• nfostealer.Gampass [Symantec]
  
• Trojan.Lineage.Gen!Pac.3 [PCTools]
  
• Trojan.Onlinegames.Gen!Pac.73 [PCTools]
  
• PWS-OnlineGames.ah [McAfee]
  
• New Malware.hw [McAfee]
  
• PWS-OnlineGames.a [McAfee]
  
• PWS-Mmorpg.gen [McAfee]
  
• WORM_ONLINEG.OXB [Trend Micro]
  
• TSPY_ONLINEG.BVZ [Trend Micro]
  
• TSPY_ONLINEGA.YS [Trend Micro]
• WORM_LEGMIR.DQ [Trend Micro]
  
• WORM_AUTORUN.ACG [Trend Micro]
  
• Cryp_Yayay [Trend Micro]
  
• TSPY_ONLINEG.WX [Trend Micro]

Non-exhaustive list

The virus kxvo.exe spreads from partition including removable drives, the virus copy two files periodically "autorun.inf" and another file, if you delete it from a partition, these two files return into their previous place a few seconds after removal.

We are not going to detail every feature of each virus, we will just see them in full.

The fix removes all variants kxvo even those who are not listed here.

The virus puts four files in the system directory

• <System>\fool0.dll
• <System>\fool1.dll
• <System>\ieso0.dll
• <System>\kxvo.exe

Puts also at least one file .dll in the temporary folder, others are created randomly

• 57heb9v5.dll
  
• 58b95y4o.dll
  
• 63j8zs.sys
  
• 757yropw.dll
  
• 7uw44.dll
  
• 8lm5ns.dll
  
• 9e7ktl.dll
  
• an.dll
• cd.dll
  
• dwyq.dll
  
• e.dll
  
• ee.dll
  
• kdk.dll
  
• lh4yhy4.dll
  
• nn.dll
  
• omq.dll
  
• p8rjys.dll
  
• q8xvk.dll
  
• t.dll
  
• vak94lt9.dll
  
• vd.dll
  
• wjlg44s8.dll
  
• wmyz.dll
  
• ybndb.dll
  
• z7.dll

And put two files in the root partition of your system:

• Autorun.inf
• 3g.com
  
• 6krxwx.cmd
  
• 800dost.com
  
• b.bat
  
• es.exe
  
• fg8m.exe
  
• g2lbn.cmd
  
• hbq.exe
  
• kso6.bat
  
• l2quk.exe
  
• lg.com
  
• lpufwi6.com
  
• lqxo8w.cmd
  
• nej30aw.exe
  
• ojbss9gv.com
  
• uulaqvl.cmd
  
• vuts0e.cmd
  
• vuts0e.cmd
  
• w00g.exe
  

The file autorun.inf is always present in the root of all partitions including removable drives, external drives or flash disks, another file accompanies it.

Creates registry's keys:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  kxva = <System>\kavo.exe
  De cette manière, le fichier kavo.exe est lancé à chaque démarrage du système
  

• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\InprocServer32
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\ProgID
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\Programmable
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\VersionIndependentProgID
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects
  
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CE7C3CF0-4B15-11D1-ABED-709549C10000}

And the values

• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\VersionIndependentProgID]
  (Default) = "IEHlprObj.IEHlprObj"
  
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\ProgID]
  (Default) = "IEHlprObj.IEHlprObj.1"
  
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}\InprocServer32]
  (Default) = "%System%\ieso0.dll"
  ThreadingModel = "Apartment"
  
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CE7C3CF0-4B15-11D1-ABED-709549C10000}]
  (Default) = "IEHlprObj Class"
  
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj\CurVer]
  (Default) = "IEHlprObj.IEHlprObj.1"
  
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj]
  (Default) = "IEHlprObj Class"
  
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1\CLSID]
  (Default) = "{CE7C3CF0-4B15-11D1-ABED-709549C10000}"
  
• [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\IEHlprObj.IEHlprObj.1]
  (Default) = "IEHlprObj Class"

This virus runs automatically each time you open or explore a partition, it is preferable to download the patch and unpack it on the desktop, reboot your machine in Safe Mode and run the patch, always in safe mode.

This virus tries to connect to the adress http://www.hg7890.com/hg2/ll.rar

This entails downloading the file ll.rar.

Safe Mode Tutorial.