H_KEY_LOCAL_MACHINE/SYSTEM/SVKP/Enum/0
H_KEY_LOCAL_MACHINE/SYSTEM/SVKP/Enum/count
H_KEY_LOCAL_MACHINE/SYSTEM/SVKP/Enum/nextinstance

within the folder there is the following entries

Name Type Data
0 REG_SZ Root\LEGACY_SVKP\0000
Count REG_DWORD 0x00000001 (1)
nextinstance REG_DWORD 0x00000001 (1)


Hope this helps
M

[b]Boot into safe mode, under your normal user name(NOT THE ADMINISTRATOR ACCOUNT).[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial61.html"]HERE[/URL].

[b]In Windows Explorer, turn on "Show all files and folders, including hidden and system".[/b] See how [URL="http://www.bleepingcomputer.com/forums/tutorial62.html"]HERE[/URL].

Click start/run and type regedit into the runbox and press the enter key.

Navigate to H_KEY_LOCAL_MACHINE/SYSTEM/[b]SVKP[/b] and delete it.

Close reg edit.

Go to C:\windows\system32\[b]SVKP.sys[/b] and delete the bold file if there.

Reboot into normal mode and rehide your protected OS files.

Let me know the results.

Regards Howard

[color=red][b]This thread is for the use of[/color] Saint M [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our [URL="http://www.techspot.com/vb/menu28.html"]security and the web forum[/URL].[/color][/b]

Thanks Howard

That seems to have done the trick.
There was no sign of SVKP.sys in C:
But deleting the SVKP folder in registry looks to have worked
I even had turned my system restore back on and created a restore point before removing the registry folder (just in case for the first attempt)
There's no sign of it.

Thanks a million
Saint M

That`s great news.

If you have any further virus/spyware problems, please post in this thread.

Regards Howard

[color=red][b]This thread is for the use of[/color] Saint M [color=red]only. Please don`t post your own virus/spyware problems in this thread. Instead, open a new thread in our [URL="http://www.techspot.com/vb/menu28.html"]security and the web forum[/URL].[/color][/b]

Hi,

I just wanted to say that what you last suggested worked for me too no more Delf~~ (well i hope its all gone and not just hiding lol)



Kind Regards,
Erii

thanks howard, your advice also helped me to kill virus.win32.delf.ak

however since i did all that stuff, my email doesnt seem to recieve, could this be somehow related? if so could you point me in the right direction to fix it. ive tried all the basic stuff (i think) like making sure my settings will actually except mail etc.

anyway, thanks again for killing this infection