Kamsoft CKVO.exe malware manual removal instructions

Description: Troj/Gamania-BW

Name: Kamsoft

Command: C:\windows\system32\ckvo.exe

This malware creates following entries in registry so that it executes whenever windows starts

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Kamsoft"=C:\windows\system32\ckvo.exe

Attacks all drives and modifies mount points key in registry so that when you double click on drives they open in new window instead of opening in same window

Example:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{05ef6149-5e60-11dd-8a88-0003254ecf1b}\shell\Autoplay\DropTarget

Resets the hidden files attributes.

Files associated with this malware that are hidden as system files in all partitions including C:\

39lpji.com
ktnquo.exe
vxl.exe
oq.cmd
fe.bat
kk3.bat
rs.cmd
autorun.inf

Files found in C:\windows\system32

ckvo.exe
ckvo0.dll
ckvo1.dll

Removal instructions:

Start the computer in safe mode by pressing F8 during booting

Open Registry Editor

Delete the value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Kamsoft"=C:\windows\system32\ckvo.exe

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\

delete all the keys starting with {........}

Example:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{05ef6149-5e60-11dd-8a88-0003254ecf1b}

In the above key delete {05ef6149-5e60-11dd-8a88-0003254ecf1b}

Open the command prompt

go to C:\>

type attrib so you can see the hidden files in root drive

To clear the attributes of malware files type

attrib -s -h -r filename

Example: C:\>attrib -s -h -r autorun.inf
D:\>attrib -s -h -r autorun.inf


repeat the above command for all files of malware

To delete the virus files type

del filename

Example: C:\> del autorun.inf
D:\> del autorun.inf

repeat the above command for all files of malware

look for the files of malware in all other partitions and delete them.

go to c:\windows\system32>

type attrib -s -h -r ckvo.exe
attrib -s -h -r ckvo.dll
attrib -s -h -r ckvo0.dll
attrib -s -h -r ckvo1.dll
del ckvo.exe
del ckvo0.dll
del ckvo1.dll

Some files in system32 may not delete then you should logoff once and logon to delete any files associated with this malware

Now open Registry editor go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL

Change the DWORD value of Checked Value from 0 to 1.

Now go to folder options and change the hidden file attributes and show system files options. You should be able to see all hidden files.

Finally turnoff the system restore and turn it on again so the previous restore points will be deleted