Phim_nguoi_lon.exe won't go away!

[wkmacc]

Hi All,
Glad to have found you guys! I have a screwy problem.

I ran Kaspersky AV-7 recently and it cleaned a trojan that was copying an autorun.ini file on my jump drive when I logged it on and also redirecting my C drive to launch Phim_nguoi_lon.exe.

I think the trojan is gone but something keeps changing my registry whenever I click on My Computer then the C drive. I get a "Windows cannot find Phim_nguoi_lon.exe..." msg.

In the registry, before I click on the C drive there are no subfolders below the reg line:

HKEY_USERS\S-1-5-21-1220037691-317499705-2780591562-1005\
Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{d4af282c-767a-11da-b68b-806d6172696f}

After I click on the C drive in My Computer, I get the "Windows cannot find Phim_nguoi_lon.exe..." and the above reg key is changed with:

\Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Phim_nguoi_lon.exe

appended to the original key

What could be doing this? I would delete it if I knew what to look for.

Thanks!

[damalloy]

Did you find a solution and what do I do with same problem

[Cyber Punk]

Hi, please download Malwarebytes' Anti-Malware to your desktop.Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware
and Launch Malwarebytes' Anti-Malware

then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.
Please post this log in your reply.

[damalloy]

Thanks. I did what you said. The error is still coming up. It occurs when I put in a memorystick duo into the J drive for photo sticks. I click on the drive and the error reads "windows can not find Phin_nguoi_lon.exe. Make sure you typed the name correctly and then try again.To search for file click start button. This is the only time in comes up that I know of.Can you help me?

Thanks
Dan

[wkmacc]

The folks at Kaspersky Antivirus advised upgrade to V9 just being rolled out in US. I did and it worked.