Originally the virus interfered with the alcohol 120% virtual scsi driver and BSOD'd windows every time it started - i fixed that by going into save mode and removing the driver.
I've run Kaspersky rescue disk, virus removal tool and antivius 2011 with latest database. Originally the behaviour was that the files were locked and couldn't be removed (even when booting of a bootcd like WinXP portable). One of the files was C:\Windows\assembly\gac_msil\desktop.ini but a whole bunch of system restore folder files were infected as well.
I ran rkill, and it was denied access to a whole bunch of processes. Then rkill.com, rkill.exe got infected.
I've also run MBAM, I don't remember it picking anything up actually. At least I haven't seen MBAM get infected.
Somehow I managed to get rid of the virus - at least it wasn't showing up under any scans.
Everything looked good until just this morning when a BSOD was caused by a kaspersky system file. Virus is back. I scanned again, but now whenever a file is found and tried to be disinfected, it disappears before the antivirus program can clean it. I actually saw this happen to two files (rkill.exe, rkill.com) on the desktop. KAV picked them up as infected, then BAM, they both disappeared & KAV reports the files as missing, not disinfected. This also happened in the KAV logs for a file that needed the PC to be rebooted to be cleaned - KAV couldn't find the file on reboot to clean it. The file that was infected then vanished was C:\Windows\system32\drivers\mrxsmb.sys, it was reported as being infected with Rootkit.Win32.ZAccess.g .
Thanks for your help guys! I really don't know what else to do now.
I'm running WinXP 32bits SP3. Currently have Kaspersky Antivirus 2011 with latest database, latest version of Malwarebytes Anti Malware and database and the latest verison of rkill available.
I've run DDS a few times but it halts every time when the #'s get underneath the 't' . Taskmgr reports flatline cpu usage but the CPU temp spikes and the fans kick in hard.
I've attached the GMER log.
PS. I've disabled the Alcohol 120% driver by renaming spsd.sys (or similar name). I couldn't open alcohol or uninstall it, it appears in remove programs but doesn't recognise its files to be uninstalled.
Edited by Skirmish, 22 November 2011 - 06:10 AM.