http://infosecurityhub.blogspot.com/2008/09/kamsoft-ckvoexe-malware-manual-removal.html
hey man, i hope you've already scanned your computer for viruses and other nasties. this is caused by viruses and in my case it was kamsoft-ckvoexe. if it's this that you've got then you'll have to remove it manually
Here is how you do it:
Start the computer in safe mode by pressing F8 during booting
Open Registry Editor
Delete the value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"Kamsoft"=C:\windows\system32\ckvo.exe
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
delete all the keys starting with {........}
Example:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{05ef6149-5e60-11dd-8a88-0003254ecf1b}
In the above key delete {05ef6149-5e60-11dd-8a88-0003254ecf1b}
Open the command prompt
go to C:\>
type attrib so you can see the hidden files in root drive
To clear the attributes of malware files type
attrib -s -h -r filename
Example: C:\>attrib -s -h -r autorun.inf
D:\>attrib -s -h -r autorun.inf
repeat the above command for all files of malware
To delete the virus files type
del filename
Example: C:\> del autorun.inf
D:\> del autorun.inf
repeat the above command for all files of malware
look for the files of malware in all other partitions and delete them.
go to c:\windows\system32>
type attrib -s -h -r ckvo.exe
attrib -s -h -r ckvo.dll
attrib -s -h -r ckvo0.dll
attrib -s -h -r ckvo1.dll
del ckvo.exe
del ckvo0.dll
del ckvo1.dll
Some files in system32 may not delete then you should logoff once and logon to delete any files associated with this malware
Now open Registry editor go to
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL
Change the DWORD value of Checked Value from 0 to 1.
Now go to folder options and change the hidden file attributes and show system files options. You should be able to see all hidden files.
Finally turnoff the system restore and turn it on again so the previous restore points will be deleted.
I hope this helps out.
