Fix for all the variants of tavo.exe

• rojan.Lineage.Gen!Pac.3 [PCTools]
• 32/Autorun.worm.bx.gen [McAfee]
  
• Infostealer.Gampass [Symantec]
  
• TSPY_ONLINEG.URC [Trend Micro]
  
• TSPY_LEGMIR.AG [Trend Micro]
  
• TSPY_ONLINEG.MI [Trend Micro]
  
• TSPY_ENCPK.AE [Trend Micro]
  
• TSPY_LEGMIR.VU [Trend Micro]
  
• W32/Autorun.worm.bx.gen [McAfee]
  
• PWS-LegMir.gen.k [McAfee]
  
• PWS-OnlineGames.a [McAfee]
  
• PWS-LegMir [McAfee]
  
• PWS-Mmorpg.gen [McAfee]

And the list is not finished.

The virus tavo.exe spreads from partition including removable drives, the virus copy two files periodically "autorun.inf" and another file, if you delete it from a partition, these two files return into their previous place a few seconds after removal.

We are not going to detail every feature of each virus, we will just see them in full.

The fix removes all variants tavo even those who are not listed here.

The virus puts three files in the system directory

• <System>\tavo.exe
• <System>\tavo0.dll
• <System>\tavo1.dll

Puts also at least one file .dll in the temporary folder, others are created randomly

• g4.dll
• avxah8.dll
• y.dll
• ig4au94g.dll
• iilov9vn.dll
• fk.dll
  
• tu58fg.dll
  
• xioao.dll
• fobq9vzc.dll
  
• 2cxs.sys
  
• uslvgy2i.dll

And put two files in the root partition of your system:

• Autorun.inf
• o.exe
• nxvhpc.exe
• ff1q0gw.bat
• i8.com
• ntdeiect

The file autorun.inf is always present in the root of all partitions including removable drives, external drives or flash disks, another file accompanies it.

Creates registry entries:

• HKCU\Software\Microsoft\Windows\CurrentVersion\Run
  tava = <System>\tavo.exe
  In this way, kavo.exe file is launched each time the system is booted
• [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
  CheckedValue = 0x00000000
  Désactive l'afficahge des fichiers cachés et les fichies systèmes

This virus runs automatically each time you open or explore a partition, it is preferable to download the patch and unpack it on the desktop, reboot your machine in Safe Mode and run the patch, always in safe mode.

This virus tries to connect to the adress http://www.1a123.com/jj/ff.rar

This entails downloading the file ff.rar

Safe mode tutorial.