Member Avatar for badage1988

hey i gt a problem with these 2 process but i managed to kill amvo but ckvo keep duplicated and the virus/ trojan found is something like win32 onlinegame blah blah blah the main function of this trojan is to steal password. and now i am running in safe mode because when i go to my normal desktop the whole screen will hang i think the trojan/virus is giving me this problem.. so what way can i do to solve for my problem. i have nod32 install ... and alot of spyware scanner and malware scanner but none of them help me thanks... .


area of infected file

system volme information
D:\windows\system32\ckvo
or ckvo.dll or ckvo1

  • 2 Contributors
  • 12 Replies
  • 222 Views
  • 15 Hours Discussion Span
  • Latest Post Latest Post by Cyber Punk

Dani AI

Generated

Good troubleshooting so far from and the effort by . This looks like a persistent backdoor/trojan that keeps a helper process running and hides copies in protected locations, so straight scans from within the infected Windows session can be blocked or undone. The next actions should focus on containment, removing hidden copies, and hunting persistence points rather than repeating ordinary on‑system scans.

Immediate containment and safe cleanup sequence:

  • Disconnect the PC from the Internet and back up personal data only (documents, photos). Do not run executables from the backup.
  • From Safe Mode with Command Prompt (or better, a clean rescue/boot CD), disable System Restore on all drives to purge the “shadow” copies where malware often hides. In XP that is My Computer -> Properties -> System Restore -> check Turn off System Restore for each drive, Apply, reboot, then re-enable if desired. This step removes hidden copies the regular scanners can miss.
  • Use a tool that shows persistent autostart points (Autoruns) and a process viewer that shows file handles (Process Explorer) to identify which service/process is originating the duplicates. If you can stop the malicious process temporarily (RKill-style tools), run a full updated on‑demand scanner (for example the one suggested) and then re-scan with a second engine or an offline rescue scanner.

Additional notes and escalation:

  • If an installed antivirus refuses to uninstall in Safe Mode, disable its startup entries (msconfig/Autoruns), boot normally, then run the vendor removal tool.
  • If the malware reappears after deletion, or desktop hangs continue, a clean reinstall is the safest route; back up files first and scan them on a clean machine.
  • Assume credentials may have been compromised: change all important passwords from a known-clean device and enable 2FA where possible.

After you run the above, post the new Autoruns and HijackThis logs (and any malware scanner logs). Those will make it practical to point to exact services/files that need to be removed or, if necessary, whether a full reinstall is the recommended next step.

Recommended Answers

All 12 Replies

Member Avatar for Cyber Punk
  1. Please download the latest copy of HijackThis from and save it to your desktop.
  2. Double click on HJTInstall.exe to install it. Click on Install. By default, it will install to C:\Program Files\Trend Micro\HijackThis.
  3. Read through the License Agreement presented to you on the next screen and click on I Accept.
  4. Once installed, HijackThis will start automatically. If it doesn't, please go to your desktop and double click on the HijackThis shortcut created there.
  5. Select Do a system scan and save a logfile.
  6. Close HijackThis.

Please post the contents of the log here.

Member Avatar for badage1988

ok i know what you mean.. i gt save the log file for eset online scanner.. combofix also if you want you can tell me.

LOG FOR HIJACKTHIS

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:57, on 2008-08-13
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode with network support

Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\Explorer.EXE
D:\Program Files\Mozilla Firefox\firefox.exe
D:\Program Files\Windows Live\Messenger\msnmsgr.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: BitDefender Toolbar - {381FFDE8-2394-4f90-B10D-FC6124A40F8C} - D:\Program Files\BitDefender\BitDefender 2008\IEToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] D:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] D:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [KTPWare] D:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [Diamondback] D:\Program Files\Razer\Diamondback 3G\razerhid.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "D:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] D:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] D:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [WinampAgent] "D:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [BitDefender Antiphishing Helper] "D:\Program Files\BitDefender\BitDefender 2008\IEShow.exe"
O4 - HKLM\..\Run: [BDAgent] "D:\Program Files\BitDefender\BitDefender 2008\bdagent.exe"
O4 - HKCU\..\Run: [MsnMsgr] "D:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "d:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [BitTorrent DNA] "D:\Program Files\DNA\btdna.exe"
O4 - Global Startup: Bluetooth.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - D:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - D:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0FC64BDC-D14D-4F04-802D-4B9104DF16FB} (SystemCheck Class) -
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) -
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) -
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
O23 - Service: Apple Mobile Device - Apple, Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - D:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - BitDefender SRL - D:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe
O23 - Service: SecureAccess Service Manager (svsvc) - Unknown owner - D:\WINDOWS\system32\svsvc.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - BitDefender S.R.L. - D:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - BitDefender - D:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe

--
End of file - 6941 bytes

Member Avatar for Cyber Punk

Hi, are you the administrator of this computer? Or are you a limited user?

Member Avatar for badage1988

i am the adminstrator i now in safe mode. cause my normal desktop keep getting hang

Member Avatar for Cyber Punk

Hi, I noticed that you were in Safe mode, and thanks for confirming that you are the administrator.

Please reopen HijackThis and click Do a system scan only and locate and place a check on the following :


O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present

close all other open windows and click Fix Checked

You have installed 2 antiviruses which explains a slow bootup and will eventually crash your computer.
Please uninstall either one of the antivirus software, by going to control panel(which is available now) and uninstall it from your computer.

Please scan and post a new HijackThis log

Member Avatar for badage1988

i want to delete the bitdefender but it is in safe mode that why i cant delete also.

Member Avatar for badage1988

is there anyway that i can stop the bitdefender from loading ..? can i go start run msconfig and untick the process for bitdefender

Member Avatar for Cyber Punk

Untick BitDefender from msconfig.
Why can't you just uninstall it from safe mode?
Exit the application and then uninstall it.

Member Avatar for badage1988

because the error it show is that you are currently in safe mode and cannot delete bitdefender from here.

Member Avatar for Cyber Punk

Ok, I didn't know that BitDefender blocks uninstall requests in Safe Mode.
I use Avira, so sorry about that.
Disable BitDefender at startup using MsConfig and boot into Normal Mode and uninstall it.
In your next reply, please include a new HijackThis log.

Member Avatar for badage1988

i off my bitdefender process but i go desktop i still hang again please help me

Member Avatar for Cyber Punk

Hi, ok, I think there may be more malware associated than I thought there was.

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
    • then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select Perform full scan, then click Scan.
    • When the scan is complete, click OK, then Show Results to view the results. Copy paste the results here so that I can have an idea of what's wrong with your system.
      Run the above in Safe Mode itself.
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.