Malwares on PC and Trojans on USB Pendrives

Hello peku006!

I'm sorry for the delay.

Same error with the F-Secure Online Scan: I had a BSOD about the driver Kilf.sys.
Then I decided to remove temporarily Kaspersky Anti Virus from my pc to do the online scan, but after the uninstallation Firefox didn't browse certains sites, like this one and the online scanner sites. I was able to browse only google and a few other sites. I tried to update Malwarebytes' but it gave me a firewall error.

Then I reinstalled Kaspersky Anti Virus on pc and now I can browse all sites without any problem.


However I remember that a few months ago I run the Eset online scanner and it went ok. Should I try with Eset?

Thank you!

Hi Flegias

Yes, let´s try it......
Please go to Eset website to perform an online scan. Please use Internet Explorer as it uses ActiveX.

1. Check (tick) this box: YES, I accept the Terms of Use.
2. Click on the Start button next to it.
3. When prompted to run ActiveX. click Yes.
4. You will be asked to install an ActiveX. Click Install.
5. Once installed, the scanner will be initialized.
6. After the scanner is initialized, click Start.
7. Uncheck (untick) Remove found threats box.
8. Check (tick) Scan unwanted applications.
9. Click on Scan.
10. It will start scanning. Please be patient.
11. Once the scan is done, you will find a log in C:\Program Files\esetonlinescanner\log.txt. Please post this log in your next reply.

Thanks peku006

# version=4
# OnlineScanner.ocx=1.0.0.635
# OnlineScannerDLLA.dll=1, 0, 0, 79
# OnlineScannerDLLW.dll=1, 0, 0, 78
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=3867 (20090219)
# vers_arch_module=1.064 (20080214)
# vers_adv_heur_module=1.066 (20070917)
# EOSSerial=054d5642696bce4bb83758b60cb7aa4d
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2009-02-19 02:33:51
# local_time=2009-02-19 03:33:51 (+0100, ora solare Europa occidentale)
# country="Italy"
# osver=5.0.2195 NT Service Pack 4
# scanned=353382
# found=0
# scan_time=9196

Is my pc clean now?

Hi Flegias

The scans are fine and it looks like your machine is clean

Next we remove all used tools.

Delete RSIT from your desktop, also delete this folder C:\rsit.

uninstall ComboFix:

• Click START then RUN
  
• Now type Combofix /u in the runbox and click OK

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Disable and Enable System Restore-WINDOWS XP
This is a good time to clear your existing system restore points and establish a new clean restore point:

Turn off System Restore

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• Check Turn off System Restore.
• Click Apply, and then click OK.
• Reboot.

Turn ON System Restore

• On the Desktop, right-click My Computer.
• Click Properties.
• Click the System Restore tab.
• UN-Check *Turn off System Restore*.
• Click Apply, and then click OK.

This will remove all restore points except the new one you just created.

Here are some free programs I recommend that could help you improve your computer's security.

Spybot Search and Destroy 1.6
Download it from here. Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install SpyWare Blaster 4.0
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com

Please check out Tony Klein's article "How did I get infected in the first place?"

Read some information here how to prevent Malware.

Is your pc running slow?
Read What to do if your Computer is running slowly

Happy surfing and stay clean!

Hello peku006!

Thank you soooo much for the help!
But a few minutes ago I put on my pc the two pendrives and Kaspersky detected and removed these:



I'm not sure that my pc is all clean!

Thank you again!

Hi Flegias

do not worry , they are deleted....

C://RECYCLER is basically a location where a users deleted files are stored

Please empty your Recycle Bin

peku006,

everytime I connect a pendrive on my pc I have those warnings by Kaspersky. Why?

Thank you.

Hi Flegias

I am sorry I made a mistake,they are on you pen drive , you must delete them

Yes, this file is on my pendrive and KAV do the deletion automatically, but when I disconnect and reconnect the pendrive I have the same reinfection and KAV delete the file again.

How can I get rid of it?

Thank you.

Hi Flegias

1. Please download Flash_Disinfector and save it to your desktop.
2. Double click to run it.
3. You will be prompted to plug in your flash drive. Plug it in.
4. Flash_Disinfector will start disinfecting your flash and hard drives. This takes a few seconds. Your desktop will disappear in the meantime.
5. When done, a message box will appear. Click OK. Your desktop should now appear. If it doesn't, press Ctrl + Shift + Esc to open Task Manager.
6. Click on File > New Task (Run...). Type in explorer.exe and press Enter. Your desktop should now appear.

post back if it helped.

Thanks peku006

I run Flash Disinfector and it created the autorun.inf but it didn't help.

The file come back every time.

Hi Flegias
Let´s try this

Start > Run. Type in: cmd.
In Command window, type: rd /s /q i:\recycler (Ensure that a space is between rd and /s and /q and i:\recycler.)
Press Enter (after pressing Enter, you will not get notification anything was done).
Type in: exit (this closes the Command window.)

I didn't get any notification after pressing Enter but the file still recreate it self after I remove and reconnect the pendrive.

Hi Flegias

Can you format it, or is there something important files.....

I formatted the pendrive but the file still recreate itself.