_________________________________
Welcome to the Forums.
The fixes we will use are specific to your problems and should only be used for this issue on this machine.
Please only use this topic to reply to. Do not start another thread.
If any other issues arise let me know.
The process is not instant. Please continue to review my answers until I tell you your machine is clear. Absence of symptoms does not mean that everything is clear. So lets do this to the end!
Save and quit any work your doing before beginning the fix.
All hijackthis logs I ask for should be done in normal mode ( not safe mode)
These logs should be done last after you have followed my instructions in the previous post.
Please if you decide to seek help at another forum let us know. There is a shortage of helpers and tying 2 of us up is a waste of time. If you have any questions about any advice given here please STOP and ask!
______________________________
RUN HJT
HJT
Run hijackthis and choose scan only and place a check by the following lines if present. Close all other windows and browsers except HJT before clicking on Fix Checked
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
C:\WINDOWS\system32\kxvo.exe
Return to OTMoveIt2, right click in the "Paste List of Files/Folders to be Moved" window (under the light blue bar) and choose Paste.
Click the red Moveit! button.
Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close OTMoveIt2
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.
___________________________________
Please download Malwarebytes' Anti-Malware to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please post the contents of that log.
If you accidently close it you may find it here.
Start -> All Programs -> Malwarebytes' Anti-Malware -> Logs
_________________________
In your next reply I would like to see:
i did all of all of what you told me, but when i opened one of my hard drives the threat seems to have gone back.
Gone back ? Do you mean gone away or come back ?
_____________________
______________________________
Make a new folder on your desktop. Call it reg finder
Download Reg Finder
Extract the files to that folder on the desktop you just created..
Go into that folder and double click RegFinder.vbs. If any of your software gives you a warning about running this just allow it. It's safe.
Type in kxvo.exe into the text field that appears and hit enter.
Again… Some protection software may probably flag the script…
just let it run.
It will let you know when its done and a log should pop up ..If it doesn't there will be a file in the folder called results.txt
If you use either the Firefox or Mozilla browsers, the box to uncheck for Cookies is on the Applications tab, under Firefox/Mozilla.
Set Cookie Retention.
Click on the Options block on the left, then choose Cookies.
Under the Cookies to delete pane, highlight any cookies you would like to retain permanently (those companies or sites with which you regularly visit or do business), and click the right arrow > to move them to the Cookies to keep pane.
Reset Temp File Removal for Regular Use.
Click on the Options block on the left. Select the Advanced button.
Check "Only delete files in Windows Temp folders older than 48 hours".
Now run the program and click on Run Cleaner
( Do not use the Registry function to clean anything with this program. Having anything auto clean your regisrty is risky).
_________________________________
Using Internet Explorer, please do a Kaspersky Online Scan
Answer Yes, when prompted to install an ActiveX component.
The program will then begin downloading the latest definition files.
Once the files have been downloaded click on NEXT
Locate the Scan Settings button & configure as follows:
Scan using the following Anti-Virus database:
Extended
Scan Options:
Scan Archives
Scan Mail Bases
Click OK & have it scan My Computer
Once the scan is complete, it will provide a report if your system is infected. It does not provide an option to clean/disinfect. We only require a report from it.
Click save report as
[external image: Posted Image]
Click the Save as Text button to save the file to your desktop and post it in your next reply
[external image: Posted Image]
Turn off the real time scanner of any existing antivirus program while performing the online scan
_________________________
In your next reply I would like to see:
i'm sorry for the late reply.
my older brother reformatted our pc, coz he thought it would get rid of the problem. but it is still there. currently, we have 2 user accounts in our pc. my account is just a limited account so i can't install hijackthis or any other program. his account is the admin, but it has a password which he doesn't want to tell me. my brother is away right now and won't be back till next week.
as of now i can't do anything to our computer but i'll be able to do something with it next week.
will this thread get deleted? should i post a new thread next week? there seems to be new problems other than kavo.exe too.
If this is your brothers computer he should probably be the one to get help fixing it.
If you truly formatted the machine ( full format not a quick format ). Your problem should be gone.
In any event I will leave this open until next Tuesday awaiting a reply.
I will need a new HJT log to start. Do not do anything else until I see that.
