I Cannot reach any Antivirus web site (and the Microsoft site)

And CWShredder (http://us.trendmicro.com/us/products/personal/CWShredder/)

Anyone else that comes to this thread will ask for a Hijack this log, so you might as well post that as well.  If you cannot connect to their site, I can try to make it available to you here or find a ftp you can use.  Is there another pc you can put the software on and run from? (usb key)

http://us.trendmicro.com/us/products/personal/free-tools-and-services/index.html?WT.mc_id=2008HP_Home_FreeTools_9292008

I had the same problem i've downloaded stopzilla from www.download.com it works for me. The program identify all problems and i delete the files myself. Don't forget to:

delete files in %temp% and C:\windows\temp
run disk cleanup utility
disable the system restore (Right click in computer -> System Proprieties -> System Restore -> Disable)

Can you get to an AV website with a different comptuer, download it to a flash drive...stop the services for your TMicro...install what you downloaded and do a scan...

If you can I would suggest Kaspersky...you get a 30 day trial license...but you HAVE to stop your TMicro...

*Waiting for the HJT log as requested above......*****

@Experts -
johnb has it right.
Quit recommending a bunch of guesses on how to fix this until the HiJackThis log is posted.
No one should recommend any action until the problem is actually identified.

@eodinoe -
We have a lot of certified Malware Experts here who have helped solve thousands of similiar problems.
If you respond with an HJT log we can help you too.
Different download link from the above:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

I'm sorry for my late answer
My server crashed down forever  (AD and OS not starting anymore...) and I had to move company services to another server.
Meanwhile another machine showed the same behavior.
I send the log of the latter server
No way to clean the WORM_DOWNAD.AD on a Windows 2000 server  
Thanks a lot

In the registry....

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
userinit.exe=

Whats the FULL value exactly?

I dont think this fiule is legit......
O4 - HKLM\..\RunServices: [Windows Firewall] C:\WINNT\wfirewall.exe  

Take it here for a full AV scan.....

Jotti's malware scan 2.99
http://virusscan.jotti.org/

Check that these are actually MS Files, and not something posing as them....

O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')

You recognize both of these?
O1 - Hosts: 217.27.65.34 crm.cgi.crs.lombardia.it
O1 - Hosts: 80.18.181.173 ns1.vegaspa.it


And are these correct?
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E3D9D3E-07CB-413A-9FB4-0826EA07BD81}: NameServer = 151.99.125.3,151.99.125.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{CD88DB3F-42E8-49C9-8AE6-6B596649CFA7}: NameServer = 192.168.20.91,192.168.20.94

Johnb6767 has good tools and good advice there. You might also like to run SDFix and Combofix.
O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM')
The above entry is probably legit, looks like he is using windows multi-lingual feature.


Below are SDBot/IRCBot entries
O4 - HKLM\..\RunServices: [Creative Audio Drivers] creative.exe  
O4 - HKLM\..\RunServices: [Windows Firewall] C:\WINNT\wfirewall.exe  
O4 - HKCU\..\RunServices: [Creative Audio Drivers] creative.exe
O4 - HKUS\.DEFAULT\..\RunServices: [Creative Audio Drivers] creative.exe (User 'Default user')

SDFix should take care of those except maybe the "wfirewall.exe" not in its database yet. Maybe Combofix will ake care of any leftovers.
Download SDFix and save it to your desktop.(either one below)
http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe
Double click SDFix and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)
Please then reboot your computer in Safe Mode by doing the following :
* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
*  Instead of Windows loading as normal, a menu with options should appear;
*  Select the first option, to run Windows in Safe Mode, then press "Enter".
*  Choose your usual account.
*  Open the extracted folder and double click "RunThis.bat" to start the script.
*  Type "Y" to begin the script.
*  It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
*  Press any Key and it will restart the PC.
*  Your system will take longer that normal to restart as the fixtool will be running and removing files.
*  When the desktop loads the Fixtool will complete the removal and display "Finished", then press any key to end the script and load your desktop icons.
*  Finally open the SDFix folder on your desktop and attach the "Report.txt" back

Is this a common or new threat?  I haven't seen this before.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
userinit.exe
The FULL value is:  C:\WINNT\system32\userinit.exe

O4 - HKLM\..\RunServices: [Windows Firewall] C:\WINNT\wfirewall.exe  
The answer from Jotti's malware scan is attached :-(

O4 - HKUS\S-1-5-18\..\Run: [internat.exe] internat.exe (User 'SYSTEM'): seems  Ok.
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Programmi\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM') : Should be OK

They are OK:
O1 - Hosts: 217.27.65.34 crm.cgi.crs.lombardia.it
O1 - Hosts: 80.18.181.173 ns1.vegaspa.it

They are correct:
O17 - HKLM\System\CCS\Services\Tcpip\..\{7E3D9D3E-07CB-413A-9FB4-0826EA07BD81}: NameServer = 151.99.125.3,151.99.125.4
O17 - HKLM\System\CCS\Services\Tcpip\..\{CD88DB3F-42E8-49C9-8AE6-6B596649CFA7}: NameServer = 192.168.20.91,192.168.20.94

mvnqzsmz.dll, jwgkvsq.vmx :
I removed them manually, but I found nothing that creates them (autorun,regmon,filemon)
I have not rebooted  the server yet (I'm afraid it won't start..)
As soon as I will end  to move all company services away from it , I'll restart it using safe mode and all the fixtools.

"The FULL value is:  C:\WINNT\system32\userinit.exe"

I think this shoiuld be "C:\WINNT\system32\userinit.exe,"  <~~~ Notice the comma..... (This is for Vista and XP I am 100% certain, cant recall exactly for Win2K flavors, but pretty sure...)