EggXpert

Byrel:

Not sure what exactly is wrong, but it seems to be more on the rootkit end. I think it probably replaced some DLL. However, no DLLs have modified times in the last month, and I know that we were infected this morning.

in "c:\windows\system32"

right-click on the column headers, this will give you a list of all possible columns to "view" and check the one called "Date Created"

the "modified date" is ok, but can be messed with easily, sort the new column in Reverse date oder, and see what has been added to that dir recently.

Do the same with the "c:\windows\system32\drivers"  dir

I have used gmer rootkit detector software for a number of years now and not been disappointed though you need to google everything it finds as not all are rootkits, some are part of device drivers for devices on your system.
 

Tallon41 

Nice.   I give you 5/5 cookies.

Tallon...in your experience, what are the worst P2P sites for getting spyware/viruses etc....i.e. which sites should folks avoid?   Limewire?

PapaHomer:

Nice.   I give you 5/5 cookies.

Tallon...in your experience, what are the worst P2P sites for getting spyware/viruses etc....i.e. which sites should folks avoid?   Limewire?

Yes.

Limewire and

Bearshare

are the the top two and 95+% of the infections I see had that software installed, some had both.

Tallon41 

ileventh - thanks for the website link.  using Malwarebytes' Anti-Malware found the problem and took care of it and my computer is now clean.

 Tallon41 - thanks for all your help and effort.  much appreciated.

can you guys suggest good AV software, anti-spyware software and firewall software?  i've decided to no longer use norton since it really didn't help me at all in this situation.  thanks.

Thank you very much! That eliminated the problem.

However, I think part of what the rootkit did prevented manual checking to see if those dlls were there.

Just in case anyone looked for them and didn't find them.

Thanks again,

Byrel

Byrel:

Thank you very much! That eliminated the problem.

However, I think part of what the rootkit did prevented manual checking to see if those dlls were there.

Which is why techs create boot CDs (like XPE Bart etc,) that allow us to boot from outside the OS installed on the box.  Makes cleaning much easier and bit faster, though running Anti-malware scans will still take the bulk of the time and that will take the same time regardless lol.

Tallon41