Virus stealing passwords, sending keystrokes

First of all, I'd like to introduce myself. My name is Netraxs, I am quite new to this forum. I am doing this for a friend because he doesn't talk in English (Lithuanian only). This virus that he has doesn't let him play SA:MP normally - enters commands that gives him trouble afterwards(insults admins, makes him leave the job ingame and etc.). Also it added a keylogger so now it has his server forum account, social network account and such. He changed the passwords so he's safe for now. When he went to make some tea, it also turned on about 50 instances of a website called Nobrain.** (I'm sure you know the content and the site's end). I told him not to logon anywhere for the time being and to unistall all p2p programs. I have the DDS logs from him so I am attaching them here. I communicate with him through skype, so I can inform him instantly as he is almost always on his PC. I'll pass him the instructions and the programs.

The GMER took like 2 hours of scanning till it finished. At the end it said that a rootkit has done something with the system, which is good and bad, considering we now know we are dealing with a rootkit.

Hello and welcome to BleepingComputer!



I am Elle and I will be helping you out with your problem. Firstly, you should know that we are working with specific tools which are used to identify the possible threats present on your system so I will analyze the results they produce.


As a start we need to have some more up-to-date logs than the ones you have already provided. The current state of the files on your system might have changed so we need to get a clear look on that aspect. DO NOT bring any changes to the system except the ones I tell you to as that may produce more damage than helping us.

If you will encounter a delay of over 2 days from me, please don't hesitate and private message me (link in the signature).
Do not forget to check your topic periodically and subscribe to it so that you can receive notifications regarding my replies.



Please generate another DDS log (download it from http://download.bleepingcomputer.com/sUBs/dds.com'>here if you haven't already) and post it in your next reply along with other changes that may have occured since you last posted.
Also download and run GMER from this link: GMER download link.



Thank you very much for your patience.




Regards,

Elle

Due to the lack of feedback, this topic is now closed.In the event you still have problems, please send me or any Moderator a Private Message and ask them to reopen this topic within the next 5 days. Please include a link to your topic in the Private Message. Thank you.