Vista - "Registry Editor has stopped working" /Trojan.Packed.NSAnti Kavo V

My real question is: How can i remove the Kavo Trojan.Packed.NSAnti virus
from my Vista system? Norton Antivirus was unsuccessful. If you have a fix
for that, that's the best thing I'm looking for.

If you can't answer that, then my question is: How can I continue to run an
application despite a Windows Error message saying, "Registry Editor has
stopped working"?

My Mother's Vista computer downloaded the kavo trojan.packed.nsanti virus
and Norton Antivirus hasn't been able to remove it. i am trying to run a
kavo-specific removal program called Kavo Killer, but whenever i run it, i
get a windows error message saying, "Registry Editor has stopped working" and
it forces me to close the program. I just want to run this kavo-killer
antivirus. how cna i continue to run it even when the registry has stopped
workin? this occurs in both regular mode and safe mode.

the error window message in more details reads:

Registry Editor has stopped working.
Windows can check online for a solution to the problem.
-->Check online for a solution and close the program
-->Close the program
Program Details:
Problem Event Name: APPCRASH
Application Name: regedit.exe
and some other stuff that probably isn't relevant.

thank you in advance for any help you might be able to offer.

vic

On Sun, 4 Jan 2009 00:26:00 -0800, vic wrote:
It's a tricky one, you may have to try several AV removal applications!
That's surprising :-)
<snip>

1.Clear the (IE) temporary Internet files and the history cache.
Click 'Start' and then click 'Run'... then type (or copy/paste)
"inetcpl.cpl" (w/out quotation marks) into the box, then click the 'OK'
button.
In Internet Properties panel 'General' tab, under 'Browsing history', click
'Delete...'button, in 'Delete Browsing History' panel, click the 'Delete
all...' button then place a checkmark into the box beside 'Also delete
files and settings stored by add-ons', Click 'Yes' and exit the Internet
Properties panel by clicking the 'OK' button.

2.Clean HDD
Delete files using Disk Cleanup (if on Vista)
http://windowshelp.microsoft.com/Win...139d91033.mspx

3.Download/execute:
Malwarebytes© Corporation - Anti-Malware
http://www.malwarebytes.org/mbam/program/mbam-setup.exe
--and--
SuperAntispyware - Free
http://www.superantispyware.com/down...NTISPYWAREFREE

--and/optional--
Kaspersky® Virus Removal Tool
http://devbuilds.kaspersky-labs.com/devbuilds/AVPTool/
http://www.kaspersky.com/support/vir...vptool?level=2
--and/optional--
Dr.Web CureIt!® Utility - FREE
http://www.freedrweb.com/cureit/
--and/optional--
a-squared Free or a-squared Command Line Scanner
http://www.emsisoft.com/en/software/download/
--and/optional--
BitDefender10 Free Edition (*NOT FOR VISTA*)
http://www.bitdefender.com/site/Down...nVersion/1/42/

NOTE:
The above mentioned applications are not capable for real-time protection
of your computer; They are on-demand scanners.

Kaspersky® Virus Removal Tool, Dr.Web CureIt!® have no update feature (so
they don't turn into full blown scanners). As soon as your computer is
cleaned you are supposed to remove these tools from your operating system
and revert back to your (updated) resident (real-time) AV application.
Re: Kaspersky® Virus Removal Tool; To uninstall/move this program 'enable
self-defense' must be unchecked!

BitDefender10 Free Edition, a-squared Free or a-squared Command Line
Scanner and the free version of Malwarebytes© and SuperAntispyware have an
update feature; Keep the latter two (2) installed in addtion to your
resident AV/A-S applications and scan frequently.

To scan your computer with the most up-to-date Kaspersky® AVPTool and
Dr.Web CureIT!® virus databases next time you should download new
Kaspersky® AVPTool and Dr.Web CureIt!® packages.

After the software is updated, it is suggested scanning the system in Safe
Mode (this does not apply to MBAM).
"Malwarebytes actually performs better in Normal Mode" says Dustin Cook,
co-author of MBAM.
Start your computer in safe mode (Vista)
http://windowshelp.microsoft.com/Win...904a11033.mspx
http://www.bleepingcomputer.com/tuto...utorial61.html

4.Download and execute HiJack This! (HJT)
http://www.trendsecure.com/portal/en...ols/hijackthis

Please, do not post HJT logs to this newsgroup.
Fora where you can get expert advice for HiJack This! (HJT) logs.

http://www.thespykiller.co.uk/index.php?board=3.0
http://www.spywarewarrior.com/viewforum.php?f=5
http://forums.tomcoyote.org/index.php?showforum=27
http://www.bleepingcomputer.com/forums/forum22.html
http://www.malwarebytes.org/forums/i...hp?showforum=7
http://www.5starsupport.com/ipboard/...p?showforum=18
http://www.theeldergeek.com/forum/in...6&showforum=29

NOTE:
Registration is required in any of the above mentioned fora before posting
a HJT log and read the 'stickies' (instructions/guidelines) for the
respective HJT forum.

5.Routinely practice Safe-Hex.
http://www.claymania.com/safe-hex.html

Good luck

On Sun, 4 Jan 2009 00:26:00 -0800, vic <vic@xxxxxx> wrote:
couple thoughts.
I've been a trend subscriber over 10 years.

I just finished the 30 day Norton 360 trial. I won't be buying it.

I'm currently running Mcaffee top of the line. So far I'm more than impressed.
It takes MUCH longer on scans than either of the above. For good reason. It
actually does the scans inside archives. ie:unpack, and scan each file inside.

No security software does it all. So hijackthis, malwarebytes, and othersis a
necessity.

As for that specific trojan. Do a google and look for the howto remove.
Actually Trend, Norton, and Mcaffee should have a solution in their virus
encyclopedias.

And then set yourself up with standard accounts and use UAC. And only usethe
admin when you're offline.

On Sun, 4 Jan 2009 00:26:00 -0800, vic <vic@xxxxxx> wrote:
addendum: how to fix registry editor.
stick the OS install disk in the DVD drive, then run FROM DOS 'SFC /scannow'.
It'll most likely fix a lot of things. And you might need to repair regedit.exe
by itself with SFC /scanfile=c:\windows\regedit.exe

On Sun, 4 Jan 2009 16:31:05 +0700, Kayman <kayhkay-nospam-@xxxxxx>
wrote:

This thing here may be as bad as the original problem you tried to use this on.
It creates folders and files all over your drive, boots on it's own, can't even
take ownership of the folders it creates.

Took a reformat to remove all traces of it.
And it didn't actually do anything when it did run.
IOW: Trouble enough removing virus, without getting into more trouble just
trying to remove the worthless virus scanners.

On Sun, 04 Jan 2009 16:27:59 -0500, keepout@xxxxxxlid wrote:
You may wish to bring this issue with Nick. He is very receptive to any
issues in relation to his software.