Hi All,
Glad to have found you guys! I have a screwy problem.

I ran Kaspersky AV-7 recently and it cleaned a trojan that was copying an autorun.ini file on my jump drive when I logged it on and also redirecting my C drive to launch Phim_nguoi_lon.exe.

I think the trojan is gone but something keeps changing my registry whenever I click on My Computer then the C drive. I get a "Windows cannot find Phim_nguoi_lon.exe..." msg.

In the registry, before I click on the C drive there are no subfolders below the reg line:

HKEY_USERS\S-1-5-21-1220037691-317499705-2780591562-1005\
Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{d4af282c-767a-11da-b68b-806d6172696f}

After I click on the C drive in My Computer, I get the "Windows cannot find Phim_nguoi_lon.exe..." and the above reg key is changed with:

\Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Phim_nguoi_lon.exe

appended to the original key

What could be doing this? I would delete it if I knew what to look for.

Thanks!