HELP! Terminal Service Trojan??

About Me:

MCSE
A+
Visual Studio Developer
Batch File Scripting
Windows Command Shell
MSC WMI MANAGEMENT

Good Evening, its like a nuclear bomb hit my state and its been 6 months since ive seen a living soul.....its refreshing to know that someone else out there has described the exact same problem i cant seem to kick...


My Theories.....
1) Virus Was Modeled Around United States Holidays
a.) Many Files "created" on 11/25/05 at 11:43 PM, on Macintosh, Windows XP, and Windows Mobile, that ive seen, although on these systems i have also seen coding that implies more versitility of the virus.
b.) Virus Overall Goal Remains the same: TOTAL CONTROL AND
EXPLOITATION of any means of data collection possible on all
c.) The knowledge level of people who recognize this virus/exploitation of configuration setting have a higher level of knowledge the the tech support reps they contact.(duh...wtf do we do now?)
d.) the geometry of hard drives(including external media devices) becomes altered permenantly by encrypting the partition information within an existing ligetimate partition, thus everytime the drive is fdisked, it is still of no affect, due to the fact that the partition is accesed through the modified bios chip before all operations.
e.)the virus propogates via ALL communication means, including powerline networking systems, bluetooth,wifi(gets reconfigured to a hacked bluetooth emulator, so to speak), tcp/ip, ipv6(microsoft REFUSES to provide any support for ipv6 whatsoever)(big factor somehow), telnet, terminal services, 1394 & serial(emulated?) connections.
f.)performs a function i have never been aware of in the past "enumeration", which i notice when i install and uninstall software, the name of the software becomes (software name) & "- enu".
g.) windows system files become lowercase
h.)programs such as taskmanager no longer display session id's other than "0" although you can clearly sort the processes by session id, and get different ascending/descending values that are NOT ascending/decesending because of anything but the TRUE value of the session id. in some ocassional times, the taskmanager will not even display a username/well known ssid/built in accout as a user... it will be completely blank for user!...... the filemenu dropdowns back color does not match the filemenubar's backcolor.... light grey on top of dark grey.
i.)many "extended windows services" and even the "standard" windows services (viewed in the microsoft management console) have different titles, different descriptions, but strangely enough have the same exact startup file name, with the same exact switches, with the same exact parameters..... wierd..... manipulation of the windows services system?
(svchost -k netsvcs) or something like that.
j.)Registry entries are ruined terribly, all file extensions are associated through a modified/non-microsoft DLL file, significant files are associated as follows (virusdllfile windowsdllfile filename additionalparameters/switches), this can be viewed in explorer.tools. folderoptions.
k.) believed to be running on java virtual pc.... but not sure.....
l.) uses python for something.....
m.)uses perl scripts ....
n.) uses unix heavily.
o.) installs via any available connection to the internet, despite permissions, displayed connectivity, and conventional means.
p.) a "unnamed" networkconnectoin is invisible from the normal PC, but can be seen from a play station portible.(crazy huh?)
q.) does remind me of an article ive read about osama bin laden.....supposedly, osama utilized a espionage technique known as stegnagraphy to actually hide files inside of files and be virtually undectable, i believe that some versions of this virus can propogate a control system using a standard ipod and modifying the internal workings of the media player system to process commands that are executed from embeded(stegnographic commands) music/media files, how?.....ive read an article where someone took a standard ipod and recorded several extremely small wav files of different unmodulated frequencies, which can somehow change the voltage reference applied the the metal backcase of an ipod and create a very limited transmitter out of the intended "chasis ground", the size of the ipods back case certainly would accomodate the minimum of 1/4 wavelength necessary to broadcast on reasonable(2.4ghz) frequencies, although it may be noted that this virus likes to obey the law as best as possible, and instead manipulate the grey areas of the law.....which leads me to the conclusion that it may actually be using the LEGAL monitering means (family frequencies) see the fcc regulations on that on, i think its like 462hz to 467hz, which would also explain the extremely slow propogation of this virus.,,,
r.) you may want to note that if you ran a disassembler on almost every executable/dll file on your computer(windows xp) you may find that the version of the file has been changed, and a $chicago entry now exists within the dll, which is a microsoft standard(and the only way to update a microsoft file after development)the coding would be in XML.i have noted that these virus related updates are associated with the number 1033.
s.) in older versions, i was able to locate a updated and manipulated version of the end user liscenese agreement, ridiculously making you a violater (with lots of words) of every aspect of "the software".
t.)BLUE TOOTH. BLUE TOOTH. this virus makes non-bluetooth devices into bluetooth devices(only for its purposes, provided the device has a transmitter, storage device, and known processor)
u.) this virus runs windows within a shell..... this virus is its OWN operating system, once it has taken control of the bios, it can emulate a pc using a virtual pc type of program that runs on its operating system, then it can make its partition invisible, then when you run dos,windows, or anything else, when you format your drive, it controls what you format,partition and see, it is invisible to you that it is running, but must make some modifications to what you thought was the operating system.




A message to all the non-believers.......

this is real.
just because you havent found it yet, you will
keep an open mind, and try to fix this problem.

i really think the goal of this virus is to obtain a worldwide topmost level administrative account, that will be able to access any computer any where, but fallen in the wrong hands(like a terrorist organization) could mean any range of unthinkable consequences for the blind eye.

if you understand what this is, we need to collaberate to find a solution, there are too few of us out there.