Jan 1 2010 Netbook running Win Xp SP3 became infected with Security Tool.
Followed all instructions on this site's "Remove Security Tool and SecurityTool (Uninstall Guide)"
Thought everything was ok and then noticed that the internet mail tab on Avast Antivirus (detail view) indicated that spam email was being sent out through my PC at an alarming rate. I only use Gmail and have never used Outlook Express on windows - so I wasn't sure if Ooutlook Express has been overtaken and was running in the background / masked.
Tried to delete Outlook Express entirely from my PC as I never use it - but discovered that Windows prevent you from deleting it fully.
Yanked out my internet cable - spam stopped obviously - and reconnected - spamm started sending again
Also noticed that a new icon popped up in the tray saying it was AVS mail scanner ...killed this and the spam stopped sending from my pc.
Decided to recan my PC and noticed that the only file that Malaware cannot delete was the NKIFWPFI.SYS file. Tried to kill / assassite application but couldn't.
Used SAFEMODE but the file persisted after reboot.
I have used all of the following programs:
- Avast Antivirus
- AVG Free
- Malwarebytes Anti-Malware
- Housecall Launcher
- Spybot S&D
The my PC started counting down syaing that it was going to shutdown in 1 minute. Was unable to override this. Restarted pc and countdown began again.
Tried using restore point for Dec 29 2009.
System seems stable ... but the NKIFWPFI.SYS file is still on my system and is identified by Malwarebytes Anti-Malware.
Not sure if this is now a false report or if this is something nasty lying dormant before attacking again.
I hope I am posting this in the correct place - if not please advise me an I will re-port this in the correct place.
All help appreciated.