Member Avatar for wkmacc

Hi All,
Glad to have found you guys! I have a screwy problem.

I ran Kaspersky AV-7 recently and it cleaned a trojan that was copying an autorun.ini file on my jump drive when I logged it on and also redirecting my C drive to launch Phim_nguoi_lon.exe.

I think the trojan is gone but something keeps changing my registry whenever I click on My Computer then the C drive. I get a "Windows cannot find Phim_nguoi_lon.exe..." msg.

In the registry, before I click on the C drive there are no subfolders below the reg line:

HKEY_USERS\S-1-5-21-1220037691-317499705-2780591562-1005\
Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{d4af282c-767a-11da-b68b-806d6172696f}

After I click on the C drive in My Computer, I get the "Windows cannot find Phim_nguoi_lon.exe..." and the above reg key is changed with:

\Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Phim_nguoi_lon.exe

appended to the original key

What could be doing this? I would delete it if I knew what to look for.

Thanks!

  • 3 Contributors
  • 4 Replies
  • 511 Views
  • 2 Months Discussion Span
  • Latest Post Latest Post by wkmacc

Dani AI

Generated

Useful summary and quick plan of action (short, practical)

This looks like a classic autorun-style persistence problem that recreates an autorun/autostart entry when a volume is opened. ’s report that an AV engine update ultimately stopped it and ’s suggestion to run an up-to-date anti‑malware scanner were both on point; ’s note that the error appears only when a memory stick is inserted strongly suggests the removable media itself is involved. (malwarebytes.com)

Immediate triage (do these first)

  • Unplug all removable media and do a full update + full-system scan with a current anti‑malware engine (Malwarebytes is a helpful secondary scanner for autorun-style worms). (malwarebytes.com)

  • Scan the removable stick from a known-clean PC (or treat it as infected and do not execute files from it).

  • Remove any hidden autorun control files on the stick (make them visible first), for example:

    attrib -h -r -s autorun.inf
del autorun.inf

Look for the persistent starter on the PC

  • Use Autoruns (Sysinternals) run as Administrator to find and disable/delete any explorer/autorun entries or per-volume launch records. Autoruns can jump to the registry/file location for you. If the offending entry reappears, something on the system or on a connected device is restoring it. (learn.microsoft.com)
  • If normal tools cannot remove the infection, run a bootable rescue scanner (offline bootable AV) to clean files that are locked while Windows runs. (support.kaspersky.com)

Preventive steps

  • Disable AutoPlay/AutoRun by policy or registry (NoDriveTypeAutoRun / Group Policy) so removable media cannot auto‑execute code; Microsoft documents the recommended settings and the security updates that hardened AutoRun behavior. Back up the registry before editing. (learn.microsoft.com)

If problems persist after these steps, collect full scanner logs and an Autoruns snapshot, back up important data, and consider using a rescue disk or professional cleanup — one forum member did resolve their case after updating AV signatures, which shows current engines matter.

Recommended Answers

All 4 Replies

Member Avatar for damalloy

Did you find a solution and what do I do with same problem

Member Avatar for Cyber Punk

Hi, please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to
    • Update Malwarebytes' Anti-Malware
    • and Launch Malwarebytes' Anti-Malware
  • then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When MBA-M finishes, Notepad will open with the log. Please save it where you can find it easily. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt.

Please post this log in your reply.

Member Avatar for damalloy

Thanks. I did what you said. The error is still coming up. It occurs when I put in a memorystick duo into the J drive for photo sticks. I click on the drive and the error reads "windows can not find Phin_nguoi_lon.exe. Make sure you typed the name correctly and then try again.To search for file click start button. This is the only time in comes up that I know of.Can you help me?

Thanks
Dan

Member Avatar for wkmacc

The folks at Kaspersky Antivirus advised upgrade to V9 just being rolled out in US. I did and it worked.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.