Kill Kavo – the NTDELECT worm-trojan removal tool patch

Written on November 29, 2007 by 59 Comments

Kill Kavo - the NTDELECT worm-trojan removal tool patchThe latest Kavo worm, otherwise known as NTDELECT, is everywhere. Using my USB alot in public computers at the university and language school there's not much I can do to avoid that Kavo worm disaster. The Kavo worm does an excellent job of manifestating itself very fast through removable media and with the underlying worm technology it's extremely difficult for the lame user to spot and remove.

Anti-virus, anti-worm, anti-spyware software doesn't seem to do much about it. Avast! detects Kavo-NTDelect but fails to remove, AVG and Symantec antivirus don't seem to care  much for it. Some of the answers given around the web suggest that Trendmicro's online Housecall service helps with Kavo-NTDelect, but so far it has done little to help me or my mates and it takes forever to run. Trendmicro and Kaspersky claim to take care of this, but I can't be sure. In any case, suggesting a 30-60US$ purchase to all my infected friends is not an option.

Here's a bit from the TrendMicro Virus-trojan-work encyclopedia about Kavo-NTdelect "WORM_ONLINEG.GBD" :

Arrival and Installation - This worm arrives via removable drives and physical drives. [...]

Autostart Technique - It creates a registry entry to enable automatic execution at every system startup. [...]

Propagation Routine - This malware propagates via removable drives and physical drives by dropping a copy of itself as NTDELECT.COM. It also drops its non-malicious component file AUTORUN.INF to automatically execute dropped copies when the said drives are accessed. [...]

Good luck trying to work with the solution proposed.

So, finally, if you're looking for something simpler, here's something Asian that simply works that I got from my Taiwanese friend here in Taiwan. I couldn't find it anywhere in the English-language web, so - knowing that many struggle with Kavo-NTdelect, I attach the Chinese based solution here. It's quite easy to use.

Download the Kavo Killer software (password: KAVO), restart in safe-mode and run the Kavo_killer.exe from the archive by selecting the right-hand button (in Chinese). That should take care of things.

Works? doesn't work? let me know...

Tags: , , , , , , 
Filed Under: PC

Related Posts

Subscribe to Updates

Subscribe to My Blog via RSS!

Follow @filination on Twitter

Or, receive updates via email:

  • relieved

    dis is the best kavo remover ever..my only regret is dat i did not get to see your post before today, thank you very much :D

    ps: u shud post dis on more websites!!!

  • http://teqsnacks.com fiLi

    Glad it helped.

    This tool is all over the Chinese-Taiwanese webosphere. I have no idea why this, or any other good Kavo killer software, has never made it to the English one. Very strange indeed.

  • Ksomaarta

    My computer windows xp has an error because of virus Kavo.

  • Purpledge

    You are a lifesaver man! I cant thank you enough! the kavo virus remover is great! rescued me from having to reformat 8 computers! if ever youre in the philippines, specifically angeles city, send me an e-mail, i owe u a drink! thank you so much!!

  • LoboAV

    Thank you, Symantec AV Corporate was useless against this nasty but Kavo_Killer took care of it. Please try to talk someone into translating it to English. Clicking the flaming panda takessuch a great leap of faith, I coouldn't do it until I had tried everything else.

  • http://benhvientinhoc.com skynet

    Your soft worked well but it made my font change. I dont know how to fix this. contact me if u can : skynet0512@yahoo.com

  • http://teqsnacks.com fiLi

    Great, I'm glad you all found this helpful.

  • Kavo Hater

    Helllo thanx Fili, for the kavo_killer.exe, i didnt noe what to do with my laptop, i was going to format it but you saved the day. but i jus dont understand what i did, i start up on safe mode, and click on the kavo_killer.exe, then i click on the right side, the icon with the fire right? but eventhough i dnt understand this i think my laptop is back to normal..il inform you if the kavo pops up again..thank you again

  • Pingback: In and Out, Wicak Hidayat » Blog Archive » Cara Menghilangkan Kavo dari PC

  • dennis

    do i have to disable avast or something?
    im running XP and avast 4.7 home edition.
    when i follow your instructions i get the box with the button on the right, when i click that i get a pop-up menu box with 7 question marks and an "OK" button.
    thats it?

  • raymond

    thanks so much....not a trace of Kavo virus exist in my PC...now I can open my flash disk without tweaking or going to the long route... kudos to you guys!!!!

  • Anurag

    Morning 8am to nnext morning 1:50am I spent time trying to remove Kavo and another virus.Instaled all the anti virus software,spyware removal softwares etc,god knows whether there is something I dont try....Inspite of all this I never gave up.Due to this try and try until you succeed spirit I found your blog and now its 2:00 am in the morning.I am done.I have won over the Kavo family.Now Tavo is left.Plzz give me solution for that also.

  • ghost

    tttttttttttttttttthhhhhhhhhhhaaaaaaaaaaaaannnnnnnnnkkkk

  • emma20

    i have kxvo.exe. i tried the taiwan program but didn't work, i don't know why! i'm hopeless. i don't know what to do. if you have other programs that will work please please please please..... show me where i can find them.

  • Henrique

    This Tool just kicks ass

  • black drg

    Where can i download this kavo_killer.exe?

  • billee

    Downloaded kavo killer at http://www.filination.com/tech/wp-content/uploads/2007/11/kavo_killer.zip

    I unzipped the file, ran it, and my anti virus detected it as a Trojan, Smalltroj.DCVL

  • http://teqsnacks.com fiLi

    Billee - I wouldn't worry about that. Antiviruses have a problematic false-positive rate.

  • Santhosh

    MAN......THANKS A LOT !!!!!!!!!!!!!

    U R A REAL LIFE SAVER !

  • chris

    I had download the kavo killer software but i don't know how to use it because that is chinese,my computer don't have chinese software that can read chinese.May I know whether there is a english version for it?Can u give me the link to download the english version to download the kavo killer software for free?Thanks.

  • http://teqsnacks.com fiLi

    Chris - just like it says on the post. Click the right big button. That's all.

  • Charles Tan

    Just to credit you too :) I've commented below on Mr. Badak's blog that reveals the solution of Kavo virus:

    This works for me! Thanks you Mr. Badak, fiLi, and whoever from Taiwan that created this kick-ass PandaKiller/KavoKiller. You guys are the Virtual World's Superheroes! :) Luckily I haven't reformatted my pc and decided to do some research on the virus. You guys rock, Cheers!

  • Annie

    Hi,. I downloaded the software. Restarted in safemode and clicked on the top right button. However when I click on it.. i get a pop up that has a series of 9 question marks "?????????" . THen I press "ok" And nothing happens. What is wrong?

  • mohammed hassan

    kavo killer fixed mi hidden folders problem

  • ROGER

    WONDERFULL!!!
    It works.... just one second!
    This worm makes me so nervous...
    PS.: Kavo Killer remove all entries from register, but don´t clear MKA.BAT.
    To completely remove, you must to delete MKA.BAT in all drives such "c:\mka.bat", d:\...
    Still, don´t forget to clean your PENDRIVE.

    Good lucky.
    Thanks a lot!!!! :D

  • Adriano

    This is the one and only kavo killer! Works great. It will be used in a massive country wide cleaning of all the computers on our network as it infected everything. We pay more than 10000U$ per year for our anti-virus. Great job in containing the threat Symantec!!! PUN INTENDED!!!
    Thanks to the chinese. for once...

  • http://chadventuranza.wordpress.com/ Sinister

    "Hi,. I downloaded the software. Restarted in safemode and clicked on the top right button. However when I click on it.. i get a pop up that has a series of 9 question marks “?????????” . Then I press “ok” And nothing happens. What is wrong?"

    Same thing for me, got the series of "???" too. Right-clicked and run - a prompt says an "extension is not running" or something like that.

    I might have a different Trojan Malware. It's in Autorun, when I open my laptop a series of prompts pop up "windows cannot find 'sys.exe',make sure you typed the name correctly and then try again.to search for a file". All my Autorun programs can't start running if I don't close the prompts. I'm having trouble opening programs now, worrying because the trojan might spread.

    I tried opening c:\Autorun to locate the virus to try and manually delete it but the same prompt which says "cannot find - make sure you typed correctly" pop up.

    I had my laptop reformatted a few months back because of a trojan too, sooo inconvenient. Now I dont have installers available for all the software I need. I'm still trying to find something that could kill my trojan without me having to resort to reformatting my laptop again.

    Sucks!

  • ross

    kavo-killer.exe really works, quick to download and easy to use.

  • ross

    kavo-killer.exe really works, the file is quick to download and easy to use.

  • Pingback: membunuh kavo « tong kosong nyaring bunyinya

  • eduard

    its infected to, avast says its has some kind of trojan or its just avast?

  • Mr Sand

    I cant download this file, well i can but as soon as i unzip it it is deleted because apparently this file is also a virus... whats the go?

  • http://teqsnacks.com fiLi

    Eduard, Mr. Sand - read the above comments, this is not a virus, though it might be detected as one. If you don't trust it, don't run it, but I bet you'll have a hard time finding any other solution. If you ran it, and it works - let the others know.

  • Giorgos

    thank you man!!

    worked for me too!

  • c0ma

    Does this work with Vista as well? dont want to risk my registry.. ;)

  • Robert Reyes

    I have virus in my PC at home. Everytime i start-up there's an error message always prompted. "kavo.exe - Application Error". and then after awhile my PC has been restarted. Is this virus same as what you have discussed -kavo worm?
    Is this one of the effect of Kavo virus, aside from creating folder?

  • DMH

    Hey, just to say thank you! this really works, i have had every symptom etc and i came to your blog.

    I got same from a hard drive, running XP-SP2, using AVG 8. I ran your software in safe mode, and then i ran it also in normal mode on restart and hey presto! it worked. I have been chasing this thing for hours....

    Apart from the language, i got the ?????? button and pressed same - all good.

    Thanks.

  • Veronica

    Thank you and I love you! YOU ROCK!!!!

  • amith

    hey i am getting a ??????? error if i click on this ..any help would be appreciated..

  • http://teqsnacks.com Fili

    amith - it's okay, it just means you don't have the Chinese character set installed. It just says that it was successfully executed.

  • No_Shit_man

    Holly Moses!!!
    It really works!!!
    Thanks!

  • =D

    I LOVE YOU!!!

    YOU DON'T UNDERSTAND HOW UPSET I WAS TO HAVE TO REFORMAT BECAUSE OF THIS P.O.S. VIRUS. I LOVE YOU MAN. (no homo)

  • Karen

    You guys are the BOMB!!!!! I actually do tech work and was at a loss with this one and totally frustrated. This program was easy and worked like a charm. Thanks a million!!!

  • Vipin

    Thanks! a lot man ,Thanks many time. thanks

    You people are awesome.

  • Randirr

    It worked as far as allowing me to access my C: drive, but I still can't use my system tools such as defragment or error-checking. Is there something more I can do? Perhaps the registry got screwed. If you have any advice, please let me know.

  • Pingback: Drives open in a new window? - Applications - TechEnclave

  • MingoCat

    Worked as promised. Thx!!!

  • http://xeromsforums.rapidboards.com/ TehCupcakes

    Heh... Amazing, I wasn't seriously expecting a little remover to work. However, it worked perfectly, exactly what I needed. Thanks a lot. :)

  • Anonymous

    You help me very much with by You delivered Kavo-NTdelect killer.
    It run OK!Thank You very much.
    Please some questions:
    How can I detect that my flash is infected by Kavo-NTdelect before
    I insert it in my PC USB?
    How can I remove (destroy) NTdelect.com on my flash, inserted in my PC USB,
    without danger to infect my PC?
    Thank You for Your answer.

  • http://teqsnacks.com Fili

    Anonymous -
    Disable autorun in your Windows for removable disks, which the Trojan uses. There are also several free software packages to disable executables in USB drives. Put the software on your drive, execute it from there, should be fine - I think.

  • karan

    its gr8...it helped me
    thanx for uploading dis

  • julius

    Worked perfect and quickly. I had an Recycler\s error and it cleared it right up!!

  • kova000

    kavo killer rules!!! hail to the creator! hail to the savior!

  • Richpa

    This KAVO KILLER works great. Thanks a lot it fix problems with hidden files and folders.

    One more time, thanks a lot!

  • Fritz

    Thank u so much! Kavo killer rules!
    After that I ran Kavo killer, I still had tmf3w3g0.com on my pen drive.
    But AVG Anti-Virus removed it ...
    Is the computer clean from viruses, then?

  • gökhan

    what is password of kill kavo rar file?

    • Fili

      gokhan - as the post says, the password is KAVO

  • http://www.blueflashphotography.com matt

    worked awesome, thanks for posting this. what a nuisance - this was the only solution that could touch this thing. again - i used symantic and it found it but couldn't clean it.

  • Kuza Kakimotor

    this is the best solution!!!!!i like it!!!!!!