Trojan or possible Kaspersky false positive

Hi,

I was hoping someone could help me - I'm at a loss what to do next.
I think I could have a Trojan false positive but I'm not really sure
I was updating my pc to Kaspersky 10 from the 9 version, but it didn't install properly as I didn't realise I had to uninstall 9 first.
What I decided to do to be totally safe was reinstall my pc to its factory settings so I think my pc should be totally clean
Its an older 2003? HP Pavilion T340 UK version and it has a recovery partition on the hard drive.
Sorry this is a bit long here but I think this might help you help me
Everything went fine until I did a Kaspersky scan - it highlighted these 2

Status: Deleted (events: 2)
12/10/2009 22:39:42 Deleted Trojan program Backdoor.Win32.Hupigon.huap C:\Program Files\Online Services\BTESAT\1890hp.exe
12/10/2009 23:24:22 Deleted Trojan program Backdoor.Win32.Hupigon.huap C:\Program Files\Online Services\BTESAT\1890hp.exe

When the 1st one came up Kaspersky said it couldn't neutrulise or delete it - but it seemed to anyway.
The 2nd one came up immediately I rebooted my pc. Earlier I had installing new Java etc so system restore points were getting done quite often

Later on these came up also - maybe due to the restore points?
Status: Deleted (events: 2)
Deleted Trojan program Backdoor.Win32.Hupigon.huap C: \System Volume Information\_ restore-(D3B0980A-A7B3-456A-A4BD-8F74FA72BA53)-\A0000808.exe
Deleted Trojan program Backdoor.Win32.Hupigon.huap C: \System Volume Information\_ restore-(D3B0980A-A7B3-456A-A4BD-8F74FA72BA53)-\A0000808.exe

So I reinstalled from scratch again but before I did a scan I looked in that Online Service folder. It had AOL, BT Openworld, Freeserve and BTESAT.
The 1890hp.exe file said it was an Internet setup program wizard, version 4.0.013 and there were 2 computers and a phone image.
BT ESAT looks like it was an Irish company back in 2003
So could there be some kind of spying device in their wizard? I've also read people saying that other HP stuff has had possible spyware in it
I turned off system restore and unticked a control panel system that allows you to ask for remote assistance

I got these after a scan again but for the other two have not yet appeared (because I have system restore off maybe?)
Status: Deleted (events: 2)
12/10/2009 22:39:42 Deleted Trojan program Backdoor.Win32.Hupigon.huap C:\Program Files\Online Services\BTESAT\1890hp.exe
12/10/2009 23:24:22 Deleted Trojan program Backdoor.Win32.Hupigon.huap C:\Program Files\Online Services\BTESAT\1890hp.exe

Kaspersky 10 was released 30 Jun 2009 I believe.
I've found very very few references to this trojan and they are all very recent as far as I can see.
So I'm hoping the reinstallation has caused all this and that Kaspersky is generating a false positive here

I'm assuming that I'm right in believing nothing from outside can surivive a reformat of the hard drive & then a reinstallation of the operating system, and that nothing can penetrate from outside and have gotten into the partition back up before I did the reinstallation?

Both these guys have the very similar problems, especially the Kaspersky link, but no resolution unfortunately
Also the bleepingcomputer one is about PCGuard (its Kaspersky powered)
http://forum.kaspersky.com/lofiversion/index.php/t130633.html
http://www.bleepingcomputer.com/forums/lofiversion/index.php/t254584.html
http://www.malwarebytes.org/forums/index.php?showtopic=25949&st=0&start=0

I've also ran Malwarebytes and its found nothing, whereas it did on the bleepingcomputer link.

Is there some really deep scanning we can do to check all this out?
Can we see if these system volume information files are still there and remove them if need be.
If you can see some digital signatures would that mean the files are OK? and its definitely a false positive
Or could that wizard have caused a serious potential risk now?
Should I wait to turn on system restore until you've looked at this?

My pc internet connection does slow and loses the connection sometimes, so does outlook, the printer once disconnected itself - that's never happened before, so that's why I'm quite unsure what to do


Many thanks

 

Thanks for replying,

I'm pretty sure I've managed to identify whats caused my problems now. I reinstalled the system from scratch again so all that was on the PC was what came pre-installed in 2003, including these ISP pre-installed set up choices which I've never used, so they've just sat dormant on the PC.

What I did before anything else this time was immediately turn off system restore so that the 1890hp.exe could not be backed up in the restore folder ''system volume information'' before I deleted it. I never went onto the internet until I had to reinstall Kaspersky and I didn't install any new/updated programs either. So I can't see how it can be anything other than a false positive now.

I then deleted that ISP set up file 1890hp.exe. Kaspersky has detected nothing since then which was what I thought should happen.

I'm sure that their can't be any infection now. I really don't think there ever was. What do you think?

The slow internet was because I was back to a really old flash player and I used the Norton removal tool prior to clean up any traces prior to installing Kaspersky this time.

Thanks

 

Hi,

Thanks, I'll have a read through all that.
I already do or know about some of the points from the past times I've used the forum. You guys have definitely helped a non-techie guy's like myself improve their knowledge over time.

Thanks again

 

Hi again,

Just finished reading all the info. Just one quick query if I may
I'm upto date on SP3, Java, etc now and I've got Malwarebytes & Spybot (although immunisation doesn't work for some reason) but I've always used them just as back up scanners every couple of weeks or so

I've got Kaspersky Internet Security 2010. I know thats firewall & antivirus.
But is that sufficient as I'm not sure if spyware stopping is part of their antivirus or do I need a proper real time spyware package that's on all the time

Thanks