FrEn

E-mail Print PDF

Kavo.exe Fix - Get rid of kavo.exe and its variants

Written by Administrator  |  Friday, 18 September 2009 07:37
AddThis Social Bookmark Button

Alias

  • Cryp_Yayay [Trend Micro]
  • Generic.dx [McAfee]
  • Infostealer.Gampass [Symantec]
  • New Malware.hw [McAfee]
  • PWS-Gamania [McAfee]
  • PWS-LegMir.gen.k [McAfee]
  • PWS-Mmorpg.gen [McAfee]
  • PWS-OnlineGames.a [McAfee]
  • TROJ_LINEAGE.KB [Trend Micro]
  • TROJ_NSANTI.MY [Trend Micro]
  • TROJ_POLYCRYP.AJ [Trend Micro]
  • Trojan Horse [Symantec]
  • Trojan.Lineage.Gen!Pac.3 [PCTools]
  • Trojan.PWS.OnLineGames.BDG [PCTools]
  • Trojan-PSW.Win32.OnLineGames.aes [Kaspersky Lab]
  • TSPY_ONLINEG.HOQ [Trend Micro]
  • TSPY_ONLINEG.HOW [Trend Micro]
  • TSPY_ONLINEG.HQO [Trend Micro]
  • TSPY_ONLINEG.OXO [Trend Micro]
  • TSPY_ONLINEG.SMB [Trend Micro]
  • TSPY_ONLINEG.ULD [Trend Micro]
  • TSPY_ONLINEG.UNT [Trend Micro]
  • TSPY_ONLINEGA.DF [Trend Micro]
  • TSPY_ONLINEGA.DZ [Trend Micro]
  • WORM_AUTORUN.ANE [Trend Micro]
  • WORM_ONLINEG.BKE [Trend Micro]
  • WORM_ONLINEG.CX [Trend Micro]
  • WORM_ONLINEG.GK [Trend Micro]


Non-exaustive list.

Information

The virus kavo.exe spreads from partition including removable drives, the virus copy two files periodically "autorun.inf" and another file, if you delete it from a partition, these two files return into their previous place a few seconds after removal.

We are not going to detail every feature of each virus, we will just see them in full.

The fix removes all variants kavo even those who are not listed here.


Fichier
The virus puts three files in the system directory

  • <System>\kavo.exe
  • <System>\kavo0.dll
  • <System>\kavo1.dll

ts also at least one file .dll in the temporary folder, others are created randomly

  • g4.dll
  • avxah8.dll
  • y.dll
  • ig4au94g.dll
  • iilov9vn.dll
  • ad.dll
  • 7z.dll
  • or.dll
  • kykvfp.dll
  • 88b4ibhq.dll
  • ee2m.dll
  • ecoimwht.dll
  • o8n4e8g9.dll
  • 48d.dll
  • ufe7kt.dll
  • xx.dll


And put two files in the root partition of your system:

  • Autorun.inf
  • o.exe
  • nxvhpc.exe
  • ff1q0gw.bat
  • i8.com
  • e6ieg.exe
  • 6qe.com
  • cfv90h.com
  • ab.cmd
  • k2.cmd
  • h2.com
  • u.exe
  • fufb6tq3.cmd
  • ekf6dbg0.com
  • h2.com
  • rtnlpipu.com
  • 1i.com
  • c18vk.exe
  • ntphyy.com

The file autorun.inf is always present in the root of all partitions including removable drives, external drives or flash disks, another file accompanies it.

Registre Creates registry entries:

  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run
    • kava = <System>\kavo.exe
In this way, kavo.exe file is launched each time the system is booted
  • [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
    • CheckedValue = 0x00000000
    • Désactive l'affichage des fichiers cachés et les fichiers systèmes


ATTENTION

This virus runs automatically each time you open or explore a partition, it is preferable to download the patch and unpack it on the desktop, reboot your machine in Safe Mode and run the patch, always in safe mode.

This virus tries to connect to the adress http://www.1a123.com/hp/zz.rar

This entails downloading the file zz.rar.

Download

 

Add comment


Security code
Refresh

Related articles
Latest posts
Free malware removal tool to remove Antivir Solution Pro
_WRITTEN_BY Administrator 15/07/2010

Antivir Solution Pro is another rogue Antispyware from the Antispyware Soft and Antivirus Suite, that tries to get money from users by prompting them to register and buy their Fake products. Some…Read more...

Free virus removal tool to remove RVHOST.exe
_WRITTEN_BY Administrator 17/06/2010
  • RVHOST.exe is a trojan that may reprensent security risk for your system, it runs in the background, this application allows remote access to the compromised system.
  • Downloads…
Read more...
Free virus removal tool to remove WinDefender.exe
_WRITTEN_BY Administrator 17/06/2010
WinDefender.exe is a trojan that may reprensent security risk for your system, it runs in the background, this application creates startup registry keys. Read more...
Free malware removal tool to get rid of Defense Center
_WRITTEN_BY Administrator 12/06/2010
Defense Center is another rogue Antispyware from the Digital Protection family, it's a malware that pretends to be an Antivirus. It is a wolf in sheep's clothing. It conducts a fake scan of your…Read more...
Free virus removal tool to remove Xss.exe
_WRITTEN_BY Administrator 10/06/2010

Xss.exe is a trojan that may reprensent security risk for your system, it runs in the background, this application allows remote access to the compromised system.

Xss.exe downloads files…Read more...

.
Information | Contact

© All Rights Reserved. net-studio.org 2009