BleepingComputer.com: W32/perlovga

recently, when i right click a drive letter (c, d, e), i notice a new item in the top of the context menu; 'Autoplay', when i click on it, a new window of windows explorer opens showing the contentes of that drive, this hapens even if i select the "open each folder in the same folder" option!

some exe files are created every time i do this...

two files is created in the root of the drive i select called copy.exe and host exe

two other file is created in the windows folder called svchost.exe xcopy.exe

two other files created in the system32 folder called temp1.exe and temp2.exe

svchost.exe and host.exe have been reported by KAV as Trojan-Dropper.Win32.Small.apl

copy.exe and xcopy.exe have been reported by KAV as Virus.Win32.Perlovga.a

temp1.exe has been reported by KAV as Virus.Win32.Perlovga.b

temp2.exe has been reported by KAV as Backdoor.Win32.small.lo

well, KAV can detect and delete all these files but they do return back when i click again on the "Autoplay" item!

After two cups of black coffee while my little noisy son is 'eating rice with angels' (literal translating of arabic expression means sleeping) i found out the fellowing :

Every time KAV detects the malicious exe files it misses (and so do i) at least one of them so it recreate itself when i double-click the drive again!

This time I manually deleted all the malicious files, removed the svchost.exe from registy so it doesn't run at start up anymore and then i did reboot my computer!

But the "Autorun" item still there and when i double-click the drive, an error message appears saying that theres no such file called copy.exe!

I then regedit, did some search and found out these three registry keys that are apparently added by the virus to add an item to the context menu for every drive I have in my computer C, D and E :

CODE
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{a8b69ec0-bff7-11da-bcaf-806d6172696f}\Shell]@="AutoRun"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{a8b69ec0-bff7-11da-bcaf-806d6172696f}\Shell\AutoRun\command]@="C:\\WINDOWS\\system32\\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{a8b69ec1-bff7-11da-bcaf-806d6172696f}\Shell]@="AutoRun"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{a8b69ec1-bff7-11da-bcaf-806d6172696f}\Shell\AutoRun\command]
@="C:\\WINDOWS\\system32\\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{a8b69ec3-bff7-11da-bcaf-806d6172696f}\Shell]@="AutoRun"

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\
{a8b69ec3-bff7-11da-bcaf-806d6172696f}\Shell\AutoRun\command]
@="C:\\WINDOWS\\system32\\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe"



I deleted those keys and the item disappeared and the 'Open' item came back to the top of the menu as the default selection so when I double-click the drive it normally shows the contents of it in the same window and no exe files are created!

Looks like problem solved!

Thank you for reading and being patient

When I do this the autoplay context option disappears from the C drive, however when I restart the computer the registry key is regenerated and the problem reappears.

Any suggestions or help as to how I can solve this would be appreciated.