cTreamer

I found now with AntiRootkit Freeware GMER litle bit more stuff.At a connection trying from winlogon.exe GMER shows me next: HOST: ircd.zief.pl PORT: 80 of caurse I've selected block allways this connection to Host. At moment I can use the internet because GMER blocked that, and I have Peace in my brain. The main Problem is still remaining so that for I gonna take some strong AntiVirus&Spyware and scan all my HARDDISCS,Partitions&Co. When that problem is fixed I gonna post again the results. First I try Sunbelts-VIPRE v3.3 and than the others, so what are you thinking good choice or not ??? cTreamer

Hallo at first to all, I've got big problem with my own Windows XP Pro Installations CD which I made with nLite tool. After the first Windows installation from that CD was everything OK at first look. After some weeks past away Windows began itself downloading TROJANS,VIRUSES and all this stuff you know. I didn't immediatly understood what's going on first 2-3 days, after I decided to lookup into my System Memmory with one Professional TaskManager. I took AnVir Task Manger Pro and move into the Processes Section. Same time below Processes Section there are shown all TCP/UDP Connections from all that small system services that are loaded into DDR-Ram. What I saw at the first look is that all services are doing their jobs well, except one that Microsoft NT Login and Logout Service called winlogon.exe. Instead that winlogon.exe service do only that what it should do, it's connecting to one IP Adresses:58.65.234.90 in Hong Kong after I seeing "connection established" winlogon.exe is downloading some small files and this filles are all TROJANS,VIRUSES,SPYWARE (rs32net.exe,reader_s.exe,head1041.exe,V1215.TEMP) and many hundred. I've burnned more than 20 CD's and every time the same you know. After WLan USB Stick Driver installing and connecting my Router, within half second recognize that winlogon.exe that I am connected to the Internet begginig that Game from the begin.At first I know now what ist the reason for that TROJAN downloading&Co and that's OK. The Problem is how I get out it from my Computer. Each time I am making my own Windows Installations CD with nLite and burnning it on CD, is also that winlogon.exe hiden without my knowledge also burnned on CD (C:\i386\). I've tried to UNPACK it you know but I get the Error"It's not possible because Visual C++ 6.0,8.0" it's look like native Microsoft file but it isn't. So what should I do, with which AntiSpyware-Virus can I fined out what is going on.I hadn't such problems with Service Pack 2 you know over 3 Years, only since I am trying to SlipStream SP3 with Windows I have this problem. Thank You all that are trying to Help me !!! cTreamer