Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


nkifwpfi.sys 750kb file

  • Please log in to reply
No replies to this topic

#1 zoolook69


  • Members
  • 1 posts
  • Local time:12:37 PM

Posted 08 January 2010 - 07:44 PM

Here is my story

Jan 1 2010 Netbook running Win Xp SP3 became infected with Security Tool.

Followed all instructions on this site's "Remove Security Tool and SecurityTool (Uninstall Guide)"

Thought everything was ok and then noticed that the internet mail tab on Avast Antivirus (detail view) indicated that spam email was being sent out through my PC at an alarming rate. I only use Gmail and have never used Outlook Express on windows - so I wasn't sure if Ooutlook Express has been overtaken and was running in the background / masked.
Tried to delete Outlook Express entirely from my PC as I never use it - but discovered that Windows prevent you from deleting it fully.
Yanked out my internet cable - spam stopped obviously - and reconnected - spamm started sending again
Also noticed that a new icon popped up in the tray saying it was AVS mail scanner ...killed this and the spam stopped sending from my pc.

Decided to recan my PC and noticed that the only file that Malaware cannot delete was the NKIFWPFI.SYS file. Tried to kill / assassite application but couldn't.
Used SAFEMODE but the file persisted after reboot.

I have used all of the following programs:
  • Avast Antivirus
  • AVG Free
  • Malwarebytes Anti-Malware
  • Killbox
  • Housecall Launcher
  • RKill
  • Spybot S&D
But nothing can get rid of this file.

The my PC started counting down syaing that it was going to shutdown in 1 minute. Was unable to override this. Restarted pc and countdown began again.

Tried using restore point for Dec 29 2009.

System seems stable ... but the NKIFWPFI.SYS file is still on my system and is identified by Malwarebytes Anti-Malware.

Not sure if this is now a false report or if this is something nasty lying dormant before attacking again.

I hope I am posting this in the correct place - if not please advise me an I will re-port this in the correct place.

All help appreciated.


BC AdBot (Login to Remove)


0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users