rn4d Dirote.exe & Kolder.exe(Mechanical Void)

I think this program tries to start an FTP service on your computer
and putting itself in C:/TEMP/
the file name of it would be "d0r1t1s.exe ". That's the file they connect
to when first connecting to the FTP site the program sets up.
by putting itself there it would be the 1st file the person sees when
visiting the FTP site, also it allows the person connecting to the FTP
site on your computer to view all your files. Because this program
allows them to browse up one directory to C:/.

ppi.exe would be the file that sets up 127.0.0.1 as the FTP site.
I kept getting an error when i started my computer up that ppi.exe
couldn't bind 127.0.0.1 as the current address because i had a
different program do it before ppi.exe could.

 

Hi and Welcome to the Windows BBS forums

Ive moved your post, its best to have started a new thread.

If you have disabled anything from starting with windows since the problems Please re-enable them, restart the PC,then post a hijackthis log for us. some one here will be glad to help.

Theres a short tutorial here
http://www.windowsbbs.com/showpost.php?p=159220&postcount=3

 

If your unable to download it or run it and sometimes theres a problem making a log "say so" please theres another way to do this,

This bug sometimes disable's downloading and running this tool.

 

Yes, welcome Mechanical Void.

Did you post in to add information to the original thread, or are you infected and looking for assistance in getting rid of it? Either way, glad to have you aboard.