Phim_nguoi_lon.exe won't go away!

[wkmacc]

Hi All,
Glad to have found you guys! I have a screwy problem.

I ran Kaspersky AV-7 recently and it cleaned a trojan that was copying an autorun.ini file on my jump drive when I logged it on and also redirecting my C drive to launch Phim_nguoi_lon.exe.

I think the trojan is gone but something keeps changing my registry whenever I click on My Computer then the C drive. I get a "Windows cannot find Phim_nguoi_lon.exe..." msg.

In the registry, before I click on the C drive there are no subfolders below the reg line:

HKEY_USERS\S-1-5-21-1220037691-317499705-2780591562-1005\
Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{d4af282c-767a-11da-b68b-806d6172696f}

After I click on the C drive in My Computer, I get the "Windows cannot find Phim_nguoi_lon.exe..." and the above reg key is changed with:

\Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Phim_nguoi_lon.exe

appended to the original key

What could be doing this? I would delete it if I knew what to look for.

Thanks!

[damalloy]

Did you find a solution and what do I do with same problem

[Cyber Punk]

Hi, please download Malwarebytes' Anti-Malware to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to
  • Update Malwarebytes' Anti-Malware
  • and Launch Malwarebytes' Anti-Malware
• then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked, and click Remove Selected.
• When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

Please post this log in your reply.

[damalloy]

Thanks. I did what you said. The error is still coming up. It occurs when I put in a memorystick duo into the J drive for photo sticks. I click on the drive and the error reads "windows can not find Phin_nguoi_lon.exe. Make sure you typed the name correctly and then try again.To search for file click start button. This is the only time in comes up that I know of.Can you help me?

Thanks
Dan

[wkmacc]

The folks at Kaspersky Antivirus advised upgrade to V9 just being rolled out in US. I did and it worked.