I can’t say for 100% that it did work completely, but you are going to help me find out. ;D 8)
After the 2 little quick fixes, I want you to do the manual procedure that you did before. Making changes as needed. ![]()
It did remove kavo.exe, but left a kavo.dll. Or else the .dll was recreated. Looking at the time stamp it may have been just an old one. It also left the mount points, that we can remove. The tool does seem to have some use. With your help we’ll find out how much.
For now we’ll do the following.
Please download the OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe by OldTimer.
Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
C:\WINDOWS\system32\kavo0.dll
Return to OTMoveIt, right click on the “Paste List of Files/Folders to be moved” window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply with a new DSS log.
Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
Now do the following registry fix
Back up your registry with erunt first
WARNING these fixes are designed for this user only and may cause damage if run on an uninfected machine
REGISTRY FIX
REGEDIT4[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{44aec12e-803c-11dc-ac38-000b6b581de1}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{4d8963b4-9976-11dc-aee9-000b6b581de1}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{7fbc6c60-9713-11dc-aedf-806d6172696f}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2{b925cbac-8af4-11dc-ac5e-000b6b581de1}]
Next you will need to create the repair registry fix to do that copy and paste ALL of the above in the quote box to a notepad file. Ensure there is no space above the REGEDIT4.
Then in notepad go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.reg
Make sure the save in box is set to desktop
This will create a fix.reg file on your desktop
http://img127.imageshack.us/img127/433/regtg8.jpg
To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.
Do the manual reset of the registry keys that you did before.
Also find and remove all the AUTORUN.INF per the instructions you found earlier.
I just want to verify that the program you used did reset all the reg keys and removed the autorun.inf
Turn off system retsore and reboot your computer. Do not use any usb storage devices for now, I’m interested in how well this program works. We’ll look at your usb after.
After you reboot run DSS again and post the log. No need for a hijackthis log.
If you have any problems, let me know.