🚀 go-pugleaf

Sorry about the crosspost to ba.internet, but I know there are malware experts 
out there.  

Does anybody have EXPERIENCE with Win32/RAMNIT.A ?  I'm having a devil of a 
time removing it.  The only tool the detects it consistently is MS Security 
Essentials, and MSSE keeps counting it and "disinfecting" it.  

I'm not sure if it's a virus or a worm.  MSSE says it's a virus, but I can't 
figure out what's launching it.

I have eliminated one rootkit and subsequent scans show no more rootkits.  
This thing has dropped startup payloads into the StartUp folder, into the Run 
keys, into Prefetch, and it masquerades as everything from random 4-letter 
clusters to names like "Microsoft Suite", etc. 

It also captures the date when Windows was first installed, so I can't 
reliably search for the thing via date, either.  

Whenever MSSE detects a new round of infections (15, 78, all kinds of counts) 
the infections are in everything from drivers to executables in all kinds of 
directories.  

At the moment I'm running the computer in safe mode with no Internet and MSSE 
is not detecting any more Ramnit.  I've scanned it 3 times.  But as soon as I 
go back into regular mode and get an Internet connection back up it'll start 
infecting again.

Oh, and I've reset the Winsock stack twice just in case there's a little 
wedgie in there.  Still comes back.

Any help would be most appreciated.  You can reach me directly by email.  The 
address is valid.

Thanks.