Security Incidents: wmon16.exe

["Jason High" <strongcypher () hotmail com>]

I believe that I have a HUGE problem, and I can't find anything anywhere.  
Here are our symptoms:
- C:\winnt\system32\wmon16.exe appeared and began running (no idea what it 
is or does)
- hosts file was altered to redirect antivirus sites to 127.0.0.1 (similar 
to Trojan.QHOST but nothing else matches
- disables antivirus
- creates lots of connections to network computers using microsoft-ds and 
netbios ports
I am completely lost.  No removal tools have worked, no A/V is picking it 
up.  I've got about four hosts with these symptoms (so far) and I'm just 
unplugging network cables at this point.  Anyone with any pointers?

Jason E. High,RHCT,GSEC,MCP
http://www.alwaysright.org

_________________________________________________________________
FREE pop-up blocking with the new MSN Toolbar – get it now! 
http://toolbar.msn.com/go/onm00200415ave/direct/01/

---------------------------------------------------------------------------
----------------------------------------------------------------------------