The main symptom of the trojan Rustock.b rootkit infection (sometimes identifed as pe386, lzx32 or msguard), is heavy network-activity without any obvious reason. When analysing the computer, the traditional malware tools do not typically find anything. However, tools like Gmer, Combofix, Smitfraudfix and SDfix are able to detect the infection:
This seems to be the case here, so run the tool advised here:
Rustock.b (pe386, lzx32, msguard) Removal Instructions:
- Download - rustbfix.exe …and save it to your desktop.
- Double click on rustbfix.exe to run the tool.
- If a Rustock.b-infection is found, you will shortly hereafter be asked to reboot the computer. The reboot will probably take quite a while, and perhaps 2 reboots will be needed. But this will happen automatically.
http://www.geekstogo.com/forum/How-to-Remove-Rustock-b-pe386-lzx32-msguard-infections-t140682.html
Sorry about the dead link from Panda; the tool is also available from MajorGeeks (and other download sites):
http://www.majorgeeks.com/Panda_Anti-Rootkit_d5457.html
Run the tool mentioned above, then re-scan with avast!, AVG Anti-spyware, Spybot etc. (because once the rootkit is removed, other malware can be detected).
