Comments on: KvmSecure http://www.precisesecurity.com/pup/kvmsecure Thu, 24 May 2012 12:56:45 +0000 hourly 1 http://wordpress.org/?v=3.3.1 By: precisesecurityhttp://www.precisesecurity.com/pup/kvmsecure#comment-1219 precisesecurity Tue, 20 May 2008 03:38:27 +0000 http://www.precisesecurity.com/threats/kvmsecure/#comment-1219 1. Temporarily Disable System Restore (Windows Me/XP/Vista/7) . <a target="_blank" href="http://www.precisesecurity.com/tools-resources/troubleshooting/how-to-enable-or-disable-system-restore-in-windows-7-and-windows-vista" rel="nofollow">[how to]</a> 2. Update the virus definitions. 3. Reboot Windows in Safe Mode. <a target="_blank" href="http://www.precisesecurity.com/tools-resources/troubleshooting/windows-safe-mode" rel="nofollow">[how to]</a> 4. Run a full system scan and clean/delete all infected file(s) 5. Delete/Modify any values added to the registry. <a target="_blank" href="http://www.precisesecurity.com/tools-resources/troubleshooting/edit-windows-registry" rel="nofollow">[how to edit registry]</a> <font color="#F97C19">Navigate to and delete the following registry entry:</font> HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows \CurrentVersion\Run\"KvmSecure.exe" = "43 00 3A 00 5C 00 50 00 72 00 6F 00 67 00 72 00 61 00 6D 00 20 00 46 00 69 00 6C 00 65 00 73 00 5C 00 4B 00 76 00 6D 00 53 00 65 00 63 00 75 00 72 00 65 00 5C 00 4B 00 76 00 6D 00 53 00 65 00 63 00 75 00 72 00 65 00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 4B 76 6D 53 65 63 75 72 65 5C 4B 76 6D 53 65 63 75 72 65 2E 65 78 65 00 74 61 72 74 20 4D 65 6E 75 5C 50 72 6F 67 72 61 6D 73 5C 4B 76 6D 53 65 63 75 72 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B2 1E 99 3F"<font color="#F97C19">Navigate to and delete the following registry subkey:</font> HKEY_CURRENT_USER\Software\KvmSecure6. Exit registry editor and restart Windows. 7. In order to make sure that threat is completely eliminated, carry out a full scan of your system using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with <a target="_blank" href="http://www.precisesecurity.com/tools-resources/threat-removal-procedure/remove-threats-with-online-virus-scanner" rel="nofollow">Online Virus Scanner</a>. 1. Temporarily Disable System Restore (Windows Me/XP/Vista/7) . [how to]
2. Update the virus definitions.
3. Reboot Windows in Safe Mode. [how to]
4. Run a full system scan and clean/delete all infected file(s)
5. Delete/Modify any values added to the registry. [how to edit registry]
Navigate to and delete the following registry entry:
HKEY_USERS\S-1-5-21-1172441840-534431857-1906119351-500\Software\Microsoft\Windows
\CurrentVersion\Run\”KvmSecure.exe” = “43 00 3A 00 5C 00 50 00 72 00 6F 00 67 00 72 00 61 00 6D 00 20 00 46 00 69 00 6C 00 65 00 73 00 5C 00 4B 00 76 00 6D 00 53 00 65 00 63 00 75 00 72 00 65 00 5C 00 4B 00 76 00 6D 00 53 00 65 00 63 00 75 00 72 00 65 00 2E 00 65 00 78 00 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 43 3A 5C 50 72 6F 67 72 61 6D 20 46 69 6C 65 73 5C 4B 76 6D 53 65 63 75 72 65 5C 4B 76 6D 53 65 63 75 72 65 2E 65 78 65 00 74 61 72 74 20 4D 65 6E 75 5C 50 72 6F 67 72 61 6D 73 5C 4B 76 6D 53 65 63 75 72 65 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B2 1E 99 3F”

Navigate to and delete the following registry subkey:
HKEY_CURRENT_USER\Software\KvmSecure

6. Exit registry editor and restart Windows.
7. In order to make sure that threat is completely eliminated, carry out a full scan of your system using AntiVirus and Antispyware Software. Another way to delete the virus using various Antivirus Program without the need to install can be done with Online Virus Scanner.

]]>