infected by some rootkit???

jus as i logged out of avast i was a victim of another torjan attack and avast does not detect this either …
it was this warez download i scaned it with avast and there was no detection but i miss on scanning it with AVG it detected this file later
it was a keygen but when i clicked on it and it asked me the directory to which i needed to install…
i thought morons have named a PATCH as a kegen and continued …30 seconds later my system went haywire…

6/9/2007 10:52:11 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\Documents and Settings\sasin\Local Settings\Temporary Internet Files\Content.IE5\10X9V5HN\ybxuerbc[1].htm” file.
6/9/2007 10:52:32 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\llmbv.exe” file.
6/9/2007 10:52:41 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\Documents and Settings\sasin\Local Settings\Temporary Internet Files\Content.IE5\UQIDXL4E\ybxuerbc[1].htm” file.
6/9/2007 10:52:44 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\llmbv.exe” file.
6/9/2007 10:52:48 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\Documents and Settings\sasin\Local Settings\Temporary Internet Files\Content.IE5\10X9V5HN\ybxuerbc[1].htm” file.
6/9/2007 10:53:18 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\llmbv.exe” file.
6/9/2007 10:53:22 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\Documents and Settings\sasin\Local Settings\Temporary Internet Files\Content.IE5\UQIDXL4E\ybxuerbc[1].htm” file.
6/9/2007 10:53:24 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\llmbv.exe” file.
6/9/2007 10:53:29 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\Documents and Settings\sasin\Local Settings\Temporary Internet Files\Content.IE5\10X9V5HN\ybxuerbc[1].htm” file.
6/9/2007 10:53:32 PM SYSTEM 1560 Sign of “Win32:Small-EKD [Trj]” has been found in “C:\llmbv.exe” file.
6/9/2007 10:53:48 PM SYSTEM 1560 Sign of “Win32:Agent-HHN [Trj]” has been found in “C:\imww.exe[UPX]” file.
6/9/2007 10:54:08 PM SYSTEM 1560 Sign of “Win32:Agent-HHN [Trj]” has been found in “C:\imww.exe[UPX]” file.
6/9/2007 10:54:12 PM SYSTEM 1560 Sign of “Win32:Agent-HHN [Trj]” has been found in “C:\imww.exe[UPX]” file.
6/9/2007 10:54:16 PM SYSTEM 1560 Sign of “Win32:Agent-HHN [Trj]” has been found in “C:\imww.exe[UPX]” file.
6/9/2007 10:54:47 PM SYSTEM 1560 Sign of “Win32:Agent-HHN [Trj]” has been found in “C:\imww.exe[UPX]” file.
6/10/2007 3:21:46 AM sasin 1372 Sign of “Win32:Agent-HHN [Trj]” has been found in “C:\imww.exe[UPX]” file.

so i unhooked my net connection and scaned my system with avg found some stuff removed it
when i scanned keygen.exe with avg here is wat i got
Downloader.loadadv AND adware.virtumonde!!!
but the problem is when i was getting these warning and even after i unhooked my system from the net i brought up my taskmanager and procress explorer but i never found any other process running other than the usual…!!!
is it some kind of rootkit???

here are virustotal results
Complete scanning result of “keygen.exe”, received in VirusTotal at 06.10.2007, 00:17:33 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.5.9.0 05.09.2007 no virus found
AntiVir 7.4.0.32 06.09.2007 DR/Dldr.LoadAdv.153433
Authentium 4.93.8 05.23.2007 W32/Downloader2.DEJ
Avast 4.7.997.0 06.09.2007 no virus found
AVG 7.5.0.467 05.08.2007 no virus found
BitDefender 7.2 06.09.2007 Trojan.Downloader.LoadAdv.B
CAT-QuickHeal 9.00 06.09.2007 no virus found
ClamAV devel-20070416 05.09.2007 no virus found
DrWeb 4.33 06.09.2007 Trojan.DownLoader.22411
eSafe 7.0.15.0 05.08.2007 no virus found
eTrust-Vet 30.7.3707 06.09.2007 no virus found
FileAdvisor 1 06.10.2007 no virus found
Fortinet 2.85.0.0 06.09.2007 W32/Dldadv!tr.dldr
F-Prot 4.3.2.48 05.08.2007 no virus found
F-Secure 6.70.13030.0 05.09.2007 no virus found
Ikarus T3.1.1.7 05.09.2007 Backdoor.Win32.Prorat.19.i
Kaspersky 4.0.2.24 06.10.2007 Trojan-Downloader.Win32.LoadAdv.gen
McAfee 5049 06.08.2007 Downloader-AWM.gen
Microsoft 1.2503 06.09.2007 no virus found
NOD32v2 2320 06.09.2007 Win32/TrojanDownloader.Small.NUS
Norman 5.80.02 06.08.2007 DLoader.CWDF
Panda 9.0.0.4 06.09.2007 Adware/CWS.LoadAdv
Prevx1 V2 06.10.2007 Prevx.Safeguard
Sophos 4.18.0 06.01.2007 Troj/Dldadv-Fam
Sunbelt 2.2.907.0 05.05.2007 VIPRE.Suspicious
Symantec 10 05.09.2007 no virus found
TheHacker 6.1.6.131 06.08.2007 no virus found
VBA32 3.12.0 06.07.2007 BackDoor.Huai
VirusBuster 4.3.23:9 06.09.2007 Trojan.DL.Loadadv.Gen
Webwasher-Gateway 6.0.1 05.09.2007 Trojan.Crypt.XPACK.Gen

and now every thing if fine but i think i may be infected with a root kit since the process did not show up…
i scanned my system with rootkit revealer i did not find any thing unusual except
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg 5/22/2007 6:00 AM 0 bytes Access is denied.
so wat should i do now???

since i have a problem getting avast to notice my torjans
http://forum.avast.com/index.php?topic=28764.0
i have attached the keygen.exe file as keygen.txt so download it and change the extension to .exe and u have got ur self a torjan… now mail it
to avast on behalf of me :smiley:

Hi sasin44,

You have to kill the following processes LOADADV552.EXE & LOADADV455.EXE
For a cleansing routine look here: http://www.techspot.com/vb/topic78907.html

polonus

I have downloaded it, added it to the User Files section of the chest and sent from there, is that how you are sending them ?
No need to zip and password protect as avast encrypts the sample when you send it, no way for any email servers scanning the attachment and deleting it before it gets to avast.

i tried to send it by adding the files thru user files but i get stuck and
incoming mail server {pop3,imap,http}
i dont know wat to enter there can any ne help me out ???

Well there should be very little to do other than enter a brief description, like undetected malware, possibly rootkit, detected on VirusTotal, see avast forum link. The default Protocol to use: option is MAPI, leave that as it is.

I assume you have a normal email account that you can send emails using an email client like OE, Thunderbird, etc. then it uses the default email account settings to send the email. Depending on your email settings the email may be sent immediately or will be in the out box waiting to be sent.