Kill Kavo - the NTDELECT worm-trojan removal tool patch
By fiLi • Nov 29th, 2007 • Category: PCThe latest Kavo worm, otherwise known as NTDELECT, is everywhere. Using my USB alot in public computers at the university and language school there’s not much I can do to avoid that Kavo worm disaster. The Kavo worm does an excellent job of manifestating itself very fast through removable media and with the underlying worm technology it’s extremely difficult for the lame user to spot and remove.
Anti-virus, anti-worm, anti-spyware software doesn’t seem to do much about it. Avast! detects Kavo-NTDelect but fails to remove, AVG and Symantec antivirus don’t seem to care much for it. Some of the answers given around the web suggest that Trendmicro’s online Housecall service helps with Kavo-NTDelect, but so far it has done little to help me or my mates and it takes forever to run. Trendmicro and Kaspersky claim to take care of this, but I can’t be sure. In any case, suggesting a 30-60US$ purchase to all my infected friends is not an option.
Here’s a bit from the TrendMicro Virus-trojan-work encyclopedia about Kavo-NTdelect "WORM_ONLINEG.GBD" :
Arrival and Installation - This worm arrives via removable drives and physical drives. [...]
Autostart Technique - It creates a registry entry to enable automatic execution at every system startup. [...]
Propagation Routine - This malware propagates via removable drives and physical drives by dropping a copy of itself as NTDELECT.COM. It also drops its non-malicious component file AUTORUN.INF to automatically execute dropped copies when the said drives are accessed. [...]
Good luck trying to work with the solution proposed.
So, finally, if you’re looking for something simpler, here’s something Asian that simply works that I got from my Taiwanese friend here in Taiwan. I couldn’t find it anywhere in the English-language web, so - knowing that many struggle with Kavo-NTdelect, I attach the Chinese based solution here. It’s quite easy to use.
Download the Kavo Killer software, restart in safe-mode and run the Kavo_killer.exe from the archive by selecting the right-hand button (in Chinese). That should take care of things.
Works? doesn’t work? let me know…
dis is the best kavo remover ever..my only regret is dat i did not get to see your post before today, thank you very much
ps: u shud post dis on more websites!!!
Glad it helped.
This tool is all over the Chinese-Taiwanese webosphere. I have no idea why this, or any other good Kavo killer software, has never made it to the English one. Very strange indeed.
My computer windows xp has an error because of virus Kavo.
You are a lifesaver man! I cant thank you enough! the kavo virus remover is great! rescued me from having to reformat 8 computers! if ever youre in the philippines, specifically angeles city, send me an e-mail, i owe u a drink! thank you so much!!
Remove Kavo Easily…
For the past few days, my laptop anti-virus has detected and removed the “Autorun-G” virus/trojan but that damn virus kept on re-appearing! This is what was reported by Avast! AV
Avast! Warning:
File Name: C:\autorun.inf
Malware-Name: INF:…
Thank you, Symantec AV Corporate was useless against this nasty but Kavo_Killer took care of it. Please try to talk someone into translating it to English. Clicking the flaming panda takessuch a great leap of faith, I coouldn’t do it until I had tried everything else.
Your soft worked well but it made my font change. I dont know how to fix this. contact me if u can : skynet0512@yahoo.com
Great, I’m glad you all found this helpful.
Helllo thanx Fili, for the kavo_killer.exe, i didnt noe what to do with my laptop, i was going to format it but you saved the day. but i jus dont understand what i did, i start up on safe mode, and click on the kavo_killer.exe, then i click on the right side, the icon with the fire right? but eventhough i dnt understand this i think my laptop is back to normal..il inform you if the kavo pops up again..thank you again
[...] ini baru baca ada removal tools (Taiwan?) untuk ngilangin Kavo. Belum sempet dicoba sih, tapi mungkin aja [...]
do i have to disable avast or something?
im running XP and avast 4.7 home edition.
when i follow your instructions i get the box with the button on the right, when i click that i get a pop-up menu box with 7 question marks and an “OK” button.
thats it?
thanks so much….not a trace of Kavo virus exist in my PC…now I can open my flash disk without tweaking or going to the long route… kudos to you guys!!!!
Morning 8am to nnext morning 1:50am I spent time trying to remove Kavo and another virus.Instaled all the anti virus software,spyware removal softwares etc,god knows whether there is something I dont try….Inspite of all this I never gave up.Due to this try and try until you succeed spirit I found your blog and now its 2:00 am in the morning.I am done.I have won over the Kavo family.Now Tavo is left.Plzz give me solution for that also.
tttttttttttttttttthhhhhhhhhhhaaaaaaaaaaaaannnnnnnnnkkkk
i have kxvo.exe. i tried the taiwan program but didn’t work, i don’t know why! i’m hopeless. i don’t know what to do. if you have other programs that will work please please please please….. show me where i can find them.
This Tool just kicks ass
Where can i download this kavo_killer.exe?
Downloaded kavo killer at http://www.filination.com/tech/wp-content/uploads/2007/11/kavo_killer.zip
I unzipped the file, ran it, and my anti virus detected it as a Trojan, Smalltroj.DCVL
Billee - I wouldn’t worry about that. Antiviruses have a problematic false-positive rate.
MAN……THANKS A LOT !!!!!!!!!!!!!
U R A REAL LIFE SAVER !
I had download the kavo killer software but i don’t know how to use it because that is chinese,my computer don’t have chinese software that can read chinese.May I know whether there is a english version for it?Can u give me the link to download the english version to download the kavo killer software for free?Thanks.
Chris - just like it says on the post. Click the right big button. That’s all.
Just to credit you too
I’ve commented below on Mr. Badak’s blog that reveals the solution of Kavo virus:
This works for me! Thanks you Mr. Badak, fiLi, and whoever from Taiwan that created this kick-ass PandaKiller/KavoKiller. You guys are the Virtual World’s Superheroes!
Luckily I haven’t reformatted my pc and decided to do some research on the virus. You guys rock, Cheers!
Hi,. I downloaded the software. Restarted in safemode and clicked on the top right button. However when I click on it.. i get a pop up that has a series of 9 question marks “?????????” . THen I press “ok” And nothing happens. What is wrong?
kavo killer fixed mi hidden folders problem
WONDERFULL!!!
It works…. just one second!
This worm makes me so nervous…
PS.: Kavo Killer remove all entries from register, but don´t clear MKA.BAT.
To completely remove, you must to delete MKA.BAT in all drives such “c:\mka.bat”, d:\…
Still, don´t forget to clean your PENDRIVE.
Good lucky.
Thanks a lot!!!!
This is the one and only kavo killer! Works great. It will be used in a massive country wide cleaning of all the computers on our network as it infected everything. We pay more than 10000U$ per year for our anti-virus. Great job in containing the threat Symantec!!! PUN INTENDED!!!
Thanks to the chinese. for once…
“Hi,. I downloaded the software. Restarted in safemode and clicked on the top right button. However when I click on it.. i get a pop up that has a series of 9 question marks “?????????” . Then I press “ok” And nothing happens. What is wrong?”
Same thing for me, got the series of “???” too. Right-clicked and run - a prompt says an “extension is not running” or something like that.
I might have a different Trojan Malware. It’s in Autorun, when I open my laptop a series of prompts pop up “windows cannot find ’sys.exe’,make sure you typed the name correctly and then try again.to search for a file”. All my Autorun programs can’t start running if I don’t close the prompts. I’m having trouble opening programs now, worrying because the trojan might spread.
I tried opening c:\Autorun to locate the virus to try and manually delete it but the same prompt which says “cannot find - make sure you typed correctly” pop up.
I had my laptop reformatted a few months back because of a trojan too, sooo inconvenient. Now I dont have installers available for all the software I need. I’m still trying to find something that could kill my trojan without me having to resort to reformatting my laptop again.
Sucks!
kavo-killer.exe really works, quick to download and easy to use.
kavo-killer.exe really works, the file is quick to download and easy to use.