How to remove kavo-liked malwares manually

The kavo malware is a nightmare for many computer users. Even worse, its varieties are booming every day. The automatic removal tools are updated regularly.

In order to remove these malwares, three tools are strongly recommended. They are autoruns, process explorer, and unlocker. These three handy tools will help you to remove these malwares. The following steps are based on these three tools. If you do not have these tools, the solution would be different.

1. Installed autoruns, process explorer, and unlocker in your system.
   
2. Restart your system in safe mode (by press F8 during computer booting.)
   
3. Run autoruns.
   
4. Checked autoruns' startup sections.
   
   1. Open a command prompt window by running cmd from run.
      
   2. Change working folder to the suspected file folder.
      
   3. By using "dir /as/ah/od" to show all hidden files.
      
   4. By using "attrib –r –h –s filename" to show up the hidden file.
      
   5. Remove the file in iv.
      
   6. Repeat iv to v till all suspected files are removed.
      
   7. Remove entry from startup section.
      
5. In the same command prompt window, doing the following steps.
   
   1. Change working folder to c:\.
      
   2. Type "attrib –r –h –s autorun.inf".
      
   3. Type "type autorun.inf".
      
   4. Remove any executable files that show in autorun.inf. In general, these files are hidden files. Therefore, you have to change their file attributes to normal (attrib –r –h –s filename).
      
   5. Remove autorun.inf from system.
      
   6. Type "mkdir autorun.inf".
      
   7. Change your working folder to next drive, such as d:\.
      
   8. Repeat ii to vii until all drives have the same procedures.
      
6. Checked autoruns' explorer hook DLLs section.
   
   1. Open suspected file's folder.
      
   2. Move mouse on the suspected file and right click mouse button.
      
   3. Choice unlocker to unlock the suspected file. It may take several times to unlock it.
      
   4. Delete this suspected file from system.
      

Done!