Can't see hidden files
Solved/Closed
crazy_devil
Posts
124
Registration date
Wednesday February 20, 2008
Status
Member
Last seen
February 6, 2009
-
Feb 22, 2008 at 12:37 AM
umbertus - Mar 22, 2017 at 12:10 AM
umbertus - Mar 22, 2017 at 12:10 AM
Related:
- Can't see files in folder not hidden
- How to see hidden stories on instagram - Guide
- Show hidden files android - Guide
- Anvi folder locker reset key - Guide
- How to clear recent files in windows 11 - Guide
- How to see hidden password in mobile - Guide
135 responses
I deleted the "checked value" key and then recreated it as in a previous post.
I had the "kavo" trojan. It make an autorun file and copies itself to any drive that you use on your computer including flash and backup driver.
Here is a link with more info:
http://64.233.169.104/search?q=cache:t42aicUnNxUJ:www.trendmicro.com/vinfo/virusencyclo/default5.asp%3FVName%3DWORM_ONLINEG.EPA%26VSect%3DT+tmf3w3g0.com&hl=en&ct=clnk&cd=2&gl=us
I had the "kavo" trojan. It make an autorun file and copies itself to any drive that you use on your computer including flash and backup driver.
Here is a link with more info:
http://64.233.169.104/search?q=cache:t42aicUnNxUJ:www.trendmicro.com/vinfo/virusencyclo/default5.asp%3FVName%3DWORM_ONLINEG.EPA%26VSect%3DT+tmf3w3g0.com&hl=en&ct=clnk&cd=2&gl=us
Danong48
Posts
3
Registration date
Monday July 7, 2008
Status
Member
Last seen
July 9, 2008
Jul 8, 2008 at 09:07 AM
Jul 8, 2008 at 09:07 AM
I solved this problem using this method on my coumputer. First scan your computer for malware (spyware) using CounterSpy V2. Download at http://www.sunbelt-software.com/Home-Home-Office/Anti-Spyware/ It's free for 2 weeks. It can detect and remove most malware. I believe it is a Trojan horse cos' the software detect a hidden file folder on my computer which link it to a porn url. After I remove that particular trojan horse and using this method to change the registry, I am able to show my hidden files. I don't think it is a virus.
Go to https://www.precisesecurity.com/antivirus/ for a clearer understanding of changing your registry using regedit.
Go to https://www.precisesecurity.com/antivirus/ for a clearer understanding of changing your registry using regedit.
hello friend ]
i am not able change registry checked value whan I change value but it is not changing plz help me how th change value
i am not able change registry checked value whan I change value but it is not changing plz help me how th change value
Didn't find the answer you are looking for?
Ask a question
use this step
Updated on 9th FEB 2008:
If still folder options is reverted back to don't show hidden files and folders then it could be due to some virus still in action.
Navigate to the following path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden
NOHIDDEN
In the NOHIDDEN folder, select CheckedValue and set the value to 1
4. Go to Tools > Folder options. This will show a folder options menu.
5. Go to View tab and select the option "Show hidden files and folder"
The above fix to the trouble came from one of our readers Chris under a virus post comment.
Updated on 9th FEB 2008:
If still folder options is reverted back to don't show hidden files and folders then it could be due to some virus still in action.
Navigate to the following path:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden
NOHIDDEN
In the NOHIDDEN folder, select CheckedValue and set the value to 1
4. Go to Tools > Folder options. This will show a folder options menu.
5. Go to View tab and select the option "Show hidden files and folder"
The above fix to the trouble came from one of our readers Chris under a virus post comment.
mrslash
Posts
159
Registration date
Wednesday February 20, 2008
Status
Member
Last seen
February 9, 2009
45
Jul 9, 2008 at 05:18 AM
Jul 9, 2008 at 05:18 AM
hi crazy devil,,,yeah I hope that you have everything alright now but this was surely due to a virus and the solution is that you should already have formatted your pc and this would have solve the mighty problem....but it is never too late so if it persist try it and whether it happens next time you know now the solution but you must have a backup storage in order to keep all your data...
I'd performed the suggested Steps but the modify key value reverts back to 0, no matter how I tried to change the value to "1"
i have d same prob but I followed ur method ofcourse I got folder options and show hidden files but actually it doesn't wrok I can't see my hidden files.plz help
i have a virus autorun.ini in my p.c. how can remove it from in my computer with out installing the anti virus.
what is the best antivirus to remove it.
what is the best antivirus to remove it.
Hello boss I am not able change registry when am I changing the show all cheked value 1 then automatic it is changing 0 pls help what should I do
surindera
surindera
dear sir
I have problem with my hidden file in my computer that not showing while i'm clicking on show hidden files through tools, folder option.
when ever i'm clicking it will became same that do not show hidden file
I have problem with my hidden file in my computer that not showing while i'm clicking on show hidden files through tools, folder option.
when ever i'm clicking it will became same that do not show hidden file
C:\autorun.inf
C:\WINDOWS\recover.reg
C:\WINDOWS\system32\ckvo.exe
C:\WINDOWS\system32\ckvo0.dll
C:\WINDOWS\system32\fool0.dll
C:\WINDOWS\system32\fool1.dll
C:\WINDOWS\system32\ieso0.dll
C:\yphhsp.cmd
this are the files that make your hidden files don't show , if this files are in your pc, nuke them out. don't know what kind of virus it is I just manage to nuke them out.
C:\WINDOWS\recover.reg
C:\WINDOWS\system32\ckvo.exe
C:\WINDOWS\system32\ckvo0.dll
C:\WINDOWS\system32\fool0.dll
C:\WINDOWS\system32\fool1.dll
C:\WINDOWS\system32\ieso0.dll
C:\yphhsp.cmd
this are the files that make your hidden files don't show , if this files are in your pc, nuke them out. don't know what kind of virus it is I just manage to nuke them out.
Hi everyone.
I reinfected both of my pc's with a removable usb flash drive by carelessness.
The "kavo.exe in one of the files (Trojan) that causes this "hidden files" fiasco.
On the following repost from a previous poster, note that it's probably better if you delete
the "CheckedValue" key, and
then recreate again, as outlined in the following:
Go to start Menu -> Run -> Type in "Regedit"
Navigate to the registry folder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Advanced\Folder\Hidden\SHO WALL
Right Click on the "CheckedValue" Key and delete it.
Now, in the pane under all of the other values, right click in an empty area and you will see
"new". Highlight "DWORD Value"
When you create it, it will probably have "New Value # 1" in the box. Rename it
"CheckedValue". Then click on it and put "1" in the "value data" box.
Now go to a file folder and up top and click Tools ->Folder Options->View. Scroll down to
"Hidden files and folders" and click "Show hidden files and folders".
Also, make sure that the following are unchecked:
Hide extensions for known file types.
Hide protected operating system files.
Click "Apply".
Now, go to Start ->Search->For Files or folders.
In the "all or part of the file name", type in Kavo.
Delete any files that you get related to this file.
In addition, go to your main root directory "C:\ and look for the file "q83iwmgf.Bat". This is
the baby that is the main cause of this "hidden file" fiasco, besides the "spyware"
possibilities.
Also, in the root directory, there may be an "autorun.inf" file that starts the "q83iwmgf.bat.
You can open the "autorun.inf with the notepad program. If you see references to the
"q83iwmgf.bat", then I would delete it. You can also just rename the "autorun.inf" to
"autorun.bak, just to play it safe.
I had Norton Antivirus, and then PC tools. Norton didn't detect the virus at all. PC tools
found some files, but Avast cleaned my computer real well. I also used cc cleaner.
Below is some info on the Kavo trojan from a tendmicro webpage:
Details:
Arrival, Installation, and Autostart Technique
This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.
It drops the following file(s)/component(s):
%System%\kavo.dll - detected as WORM_ONLINEG.TCZ
%System%\kavo.exe - copy of itself
%User Temp%\2.dll - detected as TROJ_AGENT.HCB
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)
It creates the following registry entry(ies) to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
kava = "%System%\kavo.exe"
Other System Modifications
This worm modifies the following registry key(s)/entry(ies) as part of its installation routine:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced
Hidden = "2"
(Note: The default value data for the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced
ShowSuperHidden = "0"
(Note: The default value data for the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\
Hidden\SHOWALL
CheckedValue = "0"
(Note: The default value data for the said registry entry is 1.)
Propagation via Physical/Removable/Floppy Drives
This worm drops copies of itself in all physical drives. It drops copies of itself in all removable drives. The dropped copy is named Q83IWMGF.BAT.
It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed. The said .INF file contains the following strings:
;faKwLJDsLkw329ok33asfLo8kid4ed2
[AutoRun]
;rsaa6swepL3240KIJwoaprD
open=q83iwmgf.bat
;lddw7wA4k2wZk8Sdaralaw2Seo2ijKqk3lsi5Aldir2r4swksJe3k
4i2kfKksfs4JDk0
shell\open\Command=q83iwmgf.bat
;SLs7KdassilkaDckAak30owkKisks4idk0wd4aiijsi5LlfrKfa7eoaSl
523iK6DLlqaLw3Fa2Dw4AJ
shell\open\Default=1
;dAoi
shell\explore\Command=q83iwmgf.bat
;AKis2K3ad8aoDUaswLrcAKl13K2wwZaaswdD0Jp0oLjKoj3mroD
Fkjilw3s841qwKf4rsJa02lArsiLKS532snsJ5AkLq30wjo73deirLa4
Swwal9DfqqasqDd
Affected Platforms
This worm runs on Windows 98, ME, NT, 2000, XP, and Server 2003.
Good Luck!
LJ
I reinfected both of my pc's with a removable usb flash drive by carelessness.
The "kavo.exe in one of the files (Trojan) that causes this "hidden files" fiasco.
On the following repost from a previous poster, note that it's probably better if you delete
the "CheckedValue" key, and
then recreate again, as outlined in the following:
Go to start Menu -> Run -> Type in "Regedit"
Navigate to the registry folder
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Explorer\Advanced\Folder\Hidden\SHO WALL
Right Click on the "CheckedValue" Key and delete it.
Now, in the pane under all of the other values, right click in an empty area and you will see
"new". Highlight "DWORD Value"
When you create it, it will probably have "New Value # 1" in the box. Rename it
"CheckedValue". Then click on it and put "1" in the "value data" box.
Now go to a file folder and up top and click Tools ->Folder Options->View. Scroll down to
"Hidden files and folders" and click "Show hidden files and folders".
Also, make sure that the following are unchecked:
Hide extensions for known file types.
Hide protected operating system files.
Click "Apply".
Now, go to Start ->Search->For Files or folders.
In the "all or part of the file name", type in Kavo.
Delete any files that you get related to this file.
In addition, go to your main root directory "C:\ and look for the file "q83iwmgf.Bat". This is
the baby that is the main cause of this "hidden file" fiasco, besides the "spyware"
possibilities.
Also, in the root directory, there may be an "autorun.inf" file that starts the "q83iwmgf.bat.
You can open the "autorun.inf with the notepad program. If you see references to the
"q83iwmgf.bat", then I would delete it. You can also just rename the "autorun.inf" to
"autorun.bak, just to play it safe.
I had Norton Antivirus, and then PC tools. Norton didn't detect the virus at all. PC tools
found some files, but Avast cleaned my computer real well. I also used cc cleaner.
Below is some info on the Kavo trojan from a tendmicro webpage:
Details:
Arrival, Installation, and Autostart Technique
This worm may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.
It drops the following file(s)/component(s):
%System%\kavo.dll - detected as WORM_ONLINEG.TCZ
%System%\kavo.exe - copy of itself
%User Temp%\2.dll - detected as TROJ_AGENT.HCB
(Note: %System% is the Windows system folder, which is usually C:\Windows\System on Windows 98 and ME, C:\WINNT\System32 on Windows NT and 2000, or C:\Windows\System32 on Windows XP and Server 2003. %User Temp% is the current user's Temp folder, which is usually C:\Documents and Settings\{user name}\Local Settings\Temp on Windows 2000, XP, and Server 2003.)
It creates the following registry entry(ies) to enable its automatic execution at every system startup:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Run
kava = "%System%\kavo.exe"
Other System Modifications
This worm modifies the following registry key(s)/entry(ies) as part of its installation routine:
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced
Hidden = "2"
(Note: The default value data for the said registry entry is 1.)
HKEY_CURRENT_USER\Software\Microsoft\Windows\
CurrentVersion\Explorer\Advanced
ShowSuperHidden = "0"
(Note: The default value data for the said registry entry is 1.)
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\
Hidden\SHOWALL
CheckedValue = "0"
(Note: The default value data for the said registry entry is 1.)
Propagation via Physical/Removable/Floppy Drives
This worm drops copies of itself in all physical drives. It drops copies of itself in all removable drives. The dropped copy is named Q83IWMGF.BAT.
It drops an AUTORUN.INF file to automatically execute dropped copies when the drives are accessed. The said .INF file contains the following strings:
;faKwLJDsLkw329ok33asfLo8kid4ed2
[AutoRun]
;rsaa6swepL3240KIJwoaprD
open=q83iwmgf.bat
;lddw7wA4k2wZk8Sdaralaw2Seo2ijKqk3lsi5Aldir2r4swksJe3k
4i2kfKksfs4JDk0
shell\open\Command=q83iwmgf.bat
;SLs7KdassilkaDckAak30owkKisks4idk0wd4aiijsi5LlfrKfa7eoaSl
523iK6DLlqaLw3Fa2Dw4AJ
shell\open\Default=1
;dAoi
shell\explore\Command=q83iwmgf.bat
;AKis2K3ad8aoDUaswLrcAKl13K2wwZaaswdD0Jp0oLjKoj3mroD
Fkjilw3s841qwKf4rsJa02lArsiLKS532snsJ5AkLq30wjo73deirLa4
Swwal9DfqqasqDd
Affected Platforms
This worm runs on Windows 98, ME, NT, 2000, XP, and Server 2003.
Good Luck!
LJ
Hi everyone again.
I came accross some more info on the trojan from threat expert.
I'm going to paste it instead of putting a link just in case the link gets broken.
Remember to run some spyware cleaners and antivirus programs in addition to making manual changes.
As I mentioned before, I finally used "Avast" antivrus. What I like about this program, is that it first does a
"pre - bootup" virus scan with options to move, delete, or repair a suspected file (before windows boots up).
Good Luck again.
LJ Nova
Here is the other info:
Submission Summary:
Submission details:
Submission received: 24 July 2008, 22:11:06
Processing time: 4 min 10 sec
Submitted sample:
File MD5: 0x23060C63F9DA773A0C7B6F602C6374F5
Filesize: 114,138 bytes
Alias: Trojan.Lineage.Gen!Pac.3 [PCTools], Worm.Win32.AutoRun.cgm [Kaspersky Lab], Infostealer.Gampass [Symantec], PWS-LegMir.gen.k [McAfee], TROJ_AGENT.USZ [Trend Micro]
Summary of the findings:
What's been found Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.
Technical Details:
Possible Security Risk
Attention! Characteristics of the following security risks were identified in the system:
Security Risk Description
Trojan-PWS.OnlineGames.ARun Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives.
Rootkit.Agent.QV Rootkit.Agent.QV injects rootkit components into Windows processes and attempts to hides itself from detection. It also made changes to Windows Explorer settings and download other malicious files from external servers.
Attention! The following threat categories were identified:
Threat Category Description
A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
A network-aware worm that attempts to replicate across the existing network(s)
File System Modifications
The following files were created in the system:
# Filename(s) File Size File MD5 Alias
1 c:\autorun.inf 466 bytes 0x2404A88FABFF35F1B244CDEE5664C073 Generic!atr [McAfee]
2 %Temp%\jrq4x8.dll 30,578 bytes 0x734A054AC2EC5C0C0F551E96CE5D3C56 Trojan-PWS.OnlineGames.ARun [PCTools]
Trojan-PSW.Win32.OnLineGames.qqj [Kaspersky Lab]
Infostealer.Gampass [Symantec]
PWS-LegMir.gen.k.dll [McAfee]
3 c:\q83iwmgf.bat
%System%\kavo.exe
[file and pathname of the sample #1] 114,138 bytes 0x23060C63F9DA773A0C7B6F602C6374F5 Trojan.Lineage.Gen!Pac.3 [PCTools]
Worm.Win32.AutoRun.cgm [Kaspersky Lab]
Infostealer.Gampass [Symantec]
PWS-LegMir.gen.k [McAfee]
TROJ_AGENT.USZ [Trend Micro]
4 %System%\kavo0.dll
%System%\kavo1.dll 96,768 bytes 0xDA7E52628CD4A22C1E97179B0CD7C0C4 Trojan.Lineage.Gen!Pac.3 [PCTools]
Trojan-PSW.Win32.OnLineGames.pui [Kaspersky Lab]
Packed.Generic.61 [Symantec]
PWS-LegMir.gen.k.dll [McAfee]
TSPY_GAMESONLI.C [Trend Micro]
Notes:
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Memory Modifications
There were new processes created in the system:
Process Name Process Filename Main Module Size
kavo.exe %System%\kavo.exe 233,472 bytes
[filename of the sample #1] [file and pathname of the sample #1] 233,472 bytes
There was a new memory page created in the address space of the system process(es):
Process Name Process Filename Allocated Size
explorer.exe %Windir%\explorer.exe 131,072 bytes
The following module was loaded into the address space of other process(es):
Module Name Module Filename Address Space Details
kavo0.dll %System%\kavo0.dll Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x20C0000 - 0x20EA000
Registry Modifications
The newly created Registry Value is:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
kava = "%System%\kavo.exe"
so that kavo.exe runs every time Windows starts
The following Registry Value was modified:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
CheckedValue = 0x00000000
so that hidden files and folders are not displayed in explorer when browsing the file system
Other details
The following Internet download was started (the retrieved bits are saved into the local file):
URL to be downloaded Filename for the downloaded bits
http://www.tw7890.com/pp/aa.rar %Temp%\aa.rar
I came accross some more info on the trojan from threat expert.
I'm going to paste it instead of putting a link just in case the link gets broken.
Remember to run some spyware cleaners and antivirus programs in addition to making manual changes.
As I mentioned before, I finally used "Avast" antivrus. What I like about this program, is that it first does a
"pre - bootup" virus scan with options to move, delete, or repair a suspected file (before windows boots up).
Good Luck again.
LJ Nova
Here is the other info:
Submission Summary:
Submission details:
Submission received: 24 July 2008, 22:11:06
Processing time: 4 min 10 sec
Submitted sample:
File MD5: 0x23060C63F9DA773A0C7B6F602C6374F5
Filesize: 114,138 bytes
Alias: Trojan.Lineage.Gen!Pac.3 [PCTools], Worm.Win32.AutoRun.cgm [Kaspersky Lab], Infostealer.Gampass [Symantec], PWS-LegMir.gen.k [McAfee], TROJ_AGENT.USZ [Trend Micro]
Summary of the findings:
What's been found Severity Level
Downloads/requests other files from Internet.
Modifies some system settings that may have negative impact on overall system security state.
Creates a startup registry entry.
Contains characteristics of an identified security risk.
Technical Details:
Possible Security Risk
Attention! Characteristics of the following security risks were identified in the system:
Security Risk Description
Trojan-PWS.OnlineGames.ARun Trojan-PWS.OnlineGames.ARun attempts to steal password information associated to popular online games such as MapleStory, Legend of Mir and World of Warcraft. It has the ability to spread itself via removable disk such as USB drives.
Rootkit.Agent.QV Rootkit.Agent.QV injects rootkit components into Windows processes and attempts to hides itself from detection. It also made changes to Windows Explorer settings and download other malicious files from external servers.
Attention! The following threat categories were identified:
Threat Category Description
A malicious trojan horse or bot that may represent security risk for the compromised system and/or its network environment
A keylogger program that can capture all user keystrokes (including confidential details such username, password, credit card number, etc.)
A network-aware worm that attempts to replicate across the existing network(s)
File System Modifications
The following files were created in the system:
# Filename(s) File Size File MD5 Alias
1 c:\autorun.inf 466 bytes 0x2404A88FABFF35F1B244CDEE5664C073 Generic!atr [McAfee]
2 %Temp%\jrq4x8.dll 30,578 bytes 0x734A054AC2EC5C0C0F551E96CE5D3C56 Trojan-PWS.OnlineGames.ARun [PCTools]
Trojan-PSW.Win32.OnLineGames.qqj [Kaspersky Lab]
Infostealer.Gampass [Symantec]
PWS-LegMir.gen.k.dll [McAfee]
3 c:\q83iwmgf.bat
%System%\kavo.exe
[file and pathname of the sample #1] 114,138 bytes 0x23060C63F9DA773A0C7B6F602C6374F5 Trojan.Lineage.Gen!Pac.3 [PCTools]
Worm.Win32.AutoRun.cgm [Kaspersky Lab]
Infostealer.Gampass [Symantec]
PWS-LegMir.gen.k [McAfee]
TROJ_AGENT.USZ [Trend Micro]
4 %System%\kavo0.dll
%System%\kavo1.dll 96,768 bytes 0xDA7E52628CD4A22C1E97179B0CD7C0C4 Trojan.Lineage.Gen!Pac.3 [PCTools]
Trojan-PSW.Win32.OnLineGames.pui [Kaspersky Lab]
Packed.Generic.61 [Symantec]
PWS-LegMir.gen.k.dll [McAfee]
TSPY_GAMESONLI.C [Trend Micro]
Notes:
%Temp% is a variable that refers to the temporary folder in the short path form. By default, this is C:\Documents and Settings\[UserName]\Local Settings\Temp\ (Windows NT/2000/XP).
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).
Memory Modifications
There were new processes created in the system:
Process Name Process Filename Main Module Size
kavo.exe %System%\kavo.exe 233,472 bytes
[filename of the sample #1] [file and pathname of the sample #1] 233,472 bytes
There was a new memory page created in the address space of the system process(es):
Process Name Process Filename Allocated Size
explorer.exe %Windir%\explorer.exe 131,072 bytes
The following module was loaded into the address space of other process(es):
Module Name Module Filename Address Space Details
kavo0.dll %System%\kavo0.dll Process name: explorer.exe
Process filename: %Windir%\explorer.exe
Address space: 0x20C0000 - 0x20EA000
Registry Modifications
The newly created Registry Value is:
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
kava = "%System%\kavo.exe"
so that kavo.exe runs every time Windows starts
The following Registry Value was modified:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
CheckedValue = 0x00000000
so that hidden files and folders are not displayed in explorer when browsing the file system
Other details
The following Internet download was started (the retrieved bits are saved into the local file):
URL to be downloaded Filename for the downloaded bits
http://www.tw7890.com/pp/aa.rar %Temp%\aa.rar
Attn: Moderator!!!!!!!
Please deliete my previous post.
There is a possibility that someone could clidk on the link at the bottom of my post - the part that was pasted for referece - a link was included in the info about the trojan - this web page created a clickable link.
Do not click on the link at the bottom of my previous post !!!!!!!!It was contained only for reference!
LJ
Please deliete my previous post.
There is a possibility that someone could clidk on the link at the bottom of my post - the part that was pasted for referece - a link was included in the info about the trojan - this web page created a clickable link.
Do not click on the link at the bottom of my previous post !!!!!!!!It was contained only for reference!
LJ
I normally don't reply to these threads, but I am so glad that I found this one. I'm not sure what to do after changing the key to "1" but I feel like I'm finally getting somewhere. Thanks a bunch! This is really exciting, really.
1. Go to Start --> Run, then type Regedit
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
3. Find a key called CheckedValue.
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.
courtesy from...the internet also... hehehe
2. Navigate to the registry folder HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL
3. Find a key called CheckedValue.
4. Double Click CheckedValue key and modify it to 1. This is to show all the hidden files.
courtesy from...the internet also... hehehe
Here is a simple solution - complete with a brief explanation and a .reg file to fix the problem! Once you merge the .reg file, the option to show hidden files will work again.
https://www.winhelponline.com/blog/show-hidden-files-and-folders-option-missing-or-does-not-work/
https://www.winhelponline.com/blog/show-hidden-files-and-folders-option-missing-or-does-not-work/
