How to Remove Kbdrv16.com, Lsass.exe, Usb-hi.exe in Your Computer

Just last night I copied a file from a USB of my apartment mate and I noticed that there was something wrong the way the explorer is showing. I inspect my system and found two instances of services.msc in windows task manager [press ctrl + shift + esc] one run by my currently logged user and one by SYSTEM. I searched my computer for instances of a virus or a worm, etc and I found an abnormal entries, files on my computer/registry: ITEM A +HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon under Shell string value there is an abnormal appended string c:\windows\system32\keyboard\services.exe, normal is explorer.exe +c:\documents and settings\all users\application data\fearghus\lsass.exe +C:\Documents and Settings\All Users\Application Data\Microsoft\USB2.0\usb-hi.exe +C:\Documents and Settings\All Users\Application Data\Fearghus\lsass.exe +C:\Documents and Settings\All Users\Start Menu\Programs\Startup\kbdrv16.com I successfully removed the following by: 1.) starting my windows in safe mode with command prompt (press F8 repeatedly while OS is booting) 2.) deleting the entry in the registry a.) start regedit, in the command prompt type regedit b.) navigate here HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\Current Version\Winlogon c.) change the value of the Shell key to just explorer.exe 3.) navigate to c:\documents and settings\all users\application data\ >cd c:\documents and settings\all users\application data\ a.) delete the fearghus directory >rd /s fearghus 4.) navigate to C:\Documents and Settings\All Users\Application Data\Microsoft\ >cd C:\Documents and Settings\All Users\Application Data\Microsoft\ a.) delete USB2.0 directory >rd /s USB2.0 5.) remove the entry on the Startup a.) navigate to C:\Documents and Settings\All Users\Start Menu\Programs\Startup\kbdrv16.com b.) execute delete file command >del kbdrv16.com 6.) restart your machine and boot normally, inspect the registry the Shell key should just contain explorer.exe, and all the files specified in ITEM A should be gone by now. That's all. This procedure works for me :D.