Disallowrun Registry Key

At some point of the service, some too-new virus or malware may not be detected or the removal may not have be written to the latest pattern or update.

The only way to protect the PC from being reinfected is to use the disallowrun registry key. Originally written for Windows 2000 kernel, this setting seems to work on Windows XP and other Microsoft Windows OS (later than Win2K).

Edit the Local Policy (not applicable to WinXP Home)

1. Open the gpedit.msc from the Command Prompt or the Start > Run.
2. Expand User Configuration > Administrative Templates > System
3. In the right-pane, double-click Don't run specified Windows applications
4. Click Enable, then click on the Show button
5. Click the Add button and type in the executable name that you want to block
6. For example, to block ckvo.exe, type in ckvo.exe, not the full path of the file
7. Click OK button 3 times and exit the Group Policy Object Editor
8. Restart your PC to effect the changed policy
   

Block by specific/current user

1. Open the Registry Editor
2. Go to HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
3. On the right-pane, right-click and create a new DWORD value called DisallowRun
4. Double-click on the newly-created DWORD and give it the value 1
5. Next, create a new subkey called DisallowRun under HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
6. For any program you wish to block, create a new String value, and give it a name 1. Subsequent string names, use 2, 3, 4 in a sequential manner
7. Double-click on the 1 string and type in the name of the executable you wish to block
8. Exit Registry Editor and restart the PC to effect the change.

An excerpt from Microsoft is available here.

Cheers!

ckvo Malware

I was spending too much valuable time to track down this malware. I've scanned using Kaspersky, Antivir, Spyware Doctor, XoftSpySE, Pandasecurity ActiveScan and SUPERAntiSpyware - none of which really remove the threat.

The threat first detected by the Antivir. A file called uj4fwefv.dll (or similar generated names) was found in the %TEMP%. If removed, the file will be regenerated.

It also generated an autorun.inf and l63snn8.exe in all Local Drives.

All the files mentioned are of SHR attributes.

After 2 days, I decided to go for Sysinternals Process Monitor, and monitor the source of the regenerations. It pointed to a C:\WINDOWS\SYSTEM32\ckvo.exe file. The file injects itself in the the Explorer.exe Kernel32.dll (viewed from the Stacks).

I used the BartPE CD and went on to remove all related files (including the generated files in %TEMP%). Then, just to be sure, mounted HKCU registry hive, and remove the startup referenced in HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

After the system restart, no more traces of the stubborn malware exist.

Google search for cvko.exe will reveal one post that's similar to my experience.

Update: You can actually disable the running of ckvo.exe from the HKCU\Software\Microsoft\Windows\CurrentVersion\Run. After that, restart the PC and remove all related malware files.

Cheers!