Yeah coz all databases of antivirus have just been updated with this trojan/worm
I found it in the first client (without update)
When the worm executes, it creates the following files:
%System%\kavo.exe
%System%\kavo0.dll
The file kavo0.dll is then injected into all running processes.
It also creates the following file, which is a copy of Hacktool.Rootkit:
%Temp%\[RANDOM FILE NAME].dll
The worm then copies itself to all drives from C through Z as the following file:
[DRIVE LETTER]:\ntdelect.com
It also creates the following file so that it executes whenever the drive is accessed:
[DRIVE LETTER]:\autorun.inf
Next, the worm creates the following registry entry so that it executes whenever Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion
\Run\"kava" = "%System%\kavo.exe"
It then modifies the following registry entries:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
\CurrentVersion\Explorer\Advanced\Folder\Hidden\SH OWALL
\"CheckedValue" = "0"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
\CurrentVersion\Explorer\Advanced\"Hidden" = "2"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
\CurrentVersion\Explorer\Advanced\"ShowSuperHidden " = "0"
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows
\CurrentVersion\Pocilies\Explorer\"NoDriveTypeAuto Run" = "0x91"
The worm checks if it has been injected into any of the following processes:
zhengtu.dat
elementclient.exe
dekaron.exe
hyo.exe
wsm.exe and ybclient.exe
fairlyclient.exe
so3d.exe
maplestory.exe
r2client.exe
InphaseNXD.EXE
It then attempts to steal information for the following online games:
ZhengTu
Wanmi Shijie or Perfect World
Dekaron Siwan Mojie
HuangYi Online
Rexue Jianghu
ROHAN
Seal Online
Maple Story
R2 (Reign of Revolution)
Talesweaver