fast forward 1 year+ later n this topic is still very helpful.. gerry's
instructions were very very instrumental in me fixin my own pc instead
of havin some douche reformat my hard-drive n then charge me for it.. i
run vista n used avg in safe mode to delete tha files (kmawii.exe n tha
lot) and vista manager's registry cleaner to get rid of the registry
entries... jus wanted to say thnks mch for this post!! very very
helpful!!
BisU;164915 Wrote:
> Hi Gerry, Rock
>
> Well, everything is restored! I can run regedit and msconfig and of
> course double click my way into my local disk drive!
>
> Thanks to Gerry, the link to the article he wrote did the trick. Not
> exactly the same virus though Gerry, but a variant...its KMAWII.exe
> that infected my system.
>
> Comodo BO Clean had already cleaned the file QXCTRT.exe and OSO.exe
> but I needed to remove some registry keys which were here -
>
> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image
> File Execution Options
>
> Once these were removed, I used WINRar to locate the hidden files
> Kmawii.dll and kmawii.exe in \windows\system32 folder and autorun.inf
> in my hard drive.
>
> Also, I did change the registry entry value
>
> HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Policies
> \Explorer"NoDriveTypeAutoRun" which was set to b5 by the trojan
> (apparently) to 91.
>
> After the restart...everything was fine.
>
> A lot of time wasted, but I am satisfied. Though its sick to think of
> it as an achievement...I should be angry at the computer guy who
> installed this thing on my system....
>
> I sometimes feel these viruses are nothing but marketing tacks...for
> antivirus companies..................but thats me. Lot of BS really.
>
> Anyways, thanks to all. I'll be back once this thing comes back. I
> know it will.