Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 91845 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

Kavo.exe, 2.exe, tt.exe,Tavo.exe ~ I just formatted/installed XP


  • This topic is locked This topic is locked
3 replies to this topic

#1 Reynaldo04

Reynaldo04

    New Member

  • Authentic Member
  • Pip
  • 15 posts

Posted 07 June 2008 - 09:20 PM

ughhh I just formatted and installed a XP but i did not format the 2nd partition, D:/(since there i have my drivers), so i just formatted the partition of where windows is installed.

Other information you should know is that my workgroup network(the others pc of the networks) have spywares and a lot of stuff(but i cant help it since is my dad's pc and he wont let me touch), im wondering if those spywares are coming throught the net to my PC.

Earlier right when i installed Spybot S&D it found and destroyed 2(worms?) Win32.

The main problem i have is Kavo.exe,tavo.exe,2.exe,tt.exe keep getting in my pc no matter how many times i delete them >_<, and i dont navigate in bad webpages, or anything like that, i even use 3 antispywares(2 have 24/7 security, the other one just scan):
-Spybot S&D
-Spyware Terminator
-Malewarebytes Antispyware
-----------
I dont have antivirus also, havent had for a while. Thinking about downloading AVG FREE now.

This is my clean hijack this:

Logfile of HijackThis v1.99.1
Scan saved at 8:14:55 PM, on 6/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Spyware Terminator\SpywareTerminator.exe
D:\hijackthis_sfx\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://g.live.com/1r...up/WinInstaller
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O4 - HKCU\..\Run: [tava] C:\WINDOWS\system32\tavo.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe


As you can see there appears the kavo and tavo x_x. I can manage to delete them with my antispyware but the main problem is that they just keep appearing in my pc, and i dont even navigate throught bad sites :x.


EDIT: i just scanned with Spyware Terminator and found/clean this:

Threat Files
<Trojan.W32.OLGames.KAV> : C:\WINDOWS\system32\kavo.exe
<Trojan.W32.OLGames.KAV> : C:\WINDOWS\system32\kavo0.dll

They will come back after i reboot or so i can say, i wish you help me to make it stop appearing in my pc.


Thanks in advance!~.
--------------------------
EDIT2: i realized that everytime i double click(to open) there is a .dll(i think is bad) called xfa.dll that is my Temp folder.

Edited by Reynaldo04, 07 June 2008 - 09:51 PM.

    Advertisements

Register to Remove


#2 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 08 June 2008 - 01:34 PM

Read post #4
http://forums.whatth...tml#entry465946

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 


#3 Reynaldo04

Reynaldo04

    New Member

  • Authentic Member
  • Pip
  • 15 posts

Posted 12 June 2008 - 08:42 PM

I purchased a new one at a local store and everything is ok now =D, all the problems i had got solved(thought it was my Ram or something else but no =D)

#4 LDTate

LDTate

    Forum God

  • Root Admin
  • 57,171 posts

Posted 13 June 2008 - 05:29 AM

Glad you got it fixed :thumbup:

The forum is run by volunteers who donate their time and expertise.

Want to help others? Join the ClassRoom and learn how.

Logs will be closed if you haven't replied within 3 days

 

If you would like to paypal.gif for the help you received.
 

Proud graduate of TC/WTT Classroom

 

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users