Kavo.exe Fix - Get rid of kavo.exe and its variants

Written by Administrator | Friday, 18 September 2009 07:37

Alias

Cryp_Yayay [Trend Micro]
Generic.dx [McAfee]
Infostealer.Gampass [Symantec]
New Malware.hw [McAfee]
PWS-Gamania [McAfee]
PWS-LegMir.gen.k [McAfee]
PWS-Mmorpg.gen [McAfee]
PWS-OnlineGames.a [McAfee]
TROJ_LINEAGE.KB [Trend Micro]
TROJ_NSANTI.MY [Trend Micro]
TROJ_POLYCRYP.AJ [Trend Micro]
Trojan Horse [Symantec]
Trojan.Lineage.Gen!Pac.3 [PCTools]
Trojan.PWS.OnLineGames.BDG [PCTools]
Trojan-PSW.Win32.OnLineGames.aes [Kaspersky Lab]
TSPY_ONLINEG.HOQ [Trend Micro]
TSPY_ONLINEG.HOW [Trend Micro]
TSPY_ONLINEG.HQO [Trend Micro]
TSPY_ONLINEG.OXO [Trend Micro]
TSPY_ONLINEG.SMB [Trend Micro]
TSPY_ONLINEG.ULD [Trend Micro]
TSPY_ONLINEG.UNT [Trend Micro]
TSPY_ONLINEGA.DF [Trend Micro]
TSPY_ONLINEGA.DZ [Trend Micro]
WORM_AUTORUN.ANE [Trend Micro]
WORM_ONLINEG.BKE [Trend Micro]
WORM_ONLINEG.CX [Trend Micro]
WORM_ONLINEG.GK [Trend Micro]

Non-exaustive list.

Information

The virus kavo.exe spreads from partition including removable drives, the virus copy two files periodically "autorun.inf" and another file, if you delete it from a partition, these two files return into their previous place a few seconds after removal.

We are not going to detail every feature of each virus, we will just see them in full.

The fix removes all variants kavo even those who are not listed here.

Fichier The virus puts three files in the system directory

<System>\kavo.exe
<System>\kavo0.dll
<System>\kavo1.dll

ts also at least one file .dll in the temporary folder, others are created randomly

g4.dll
avxah8.dll
y.dll
ig4au94g.dll
iilov9vn.dll
ad.dll
7z.dll
or.dll
kykvfp.dll
88b4ibhq.dll
ee2m.dll
ecoimwht.dll
o8n4e8g9.dll
48d.dll
ufe7kt.dll
xx.dll

And put two files in the root partition of your system:

Autorun.inf
o.exe
nxvhpc.exe
ff1q0gw.bat
i8.com
e6ieg.exe
6qe.com
cfv90h.com
ab.cmd
k2.cmd
h2.com
u.exe
fufb6tq3.cmd
ekf6dbg0.com
h2.com
rtnlpipu.com
1i.com
c18vk.exe
ntphyy.com

The file autorun.inf is always present in the root of all partitions including removable drives, external drives or flash disks, another file accompanies it.

Registre Creates registry entries:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run
- kava = <System>\kavo.exe

In this way, kavo.exe file is launched each time the system is booted

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
- CheckedValue = 0x00000000
- Désactive l'affichage des fichiers cachés et les fichiers systèmes

ATTENTION

This virus runs automatically each time you open or explore a partition, it is preferable to download the patch and unpack it on the desktop, reboot your machine in Safe Mode and run the patch, always in safe mode.

This virus tries to connect to the adress http://www.1a123.com/hp/zz.rar

This entails downloading the file zz.rar.