Well, some of the stuff has already been posted, but here is the way I take when removing rootkits or some lame script kiddies FTP or Iroffer Kits.
1. Run fport.exe and see what processes are running on which port. Use some common sense and find out which ones are suspicious.
2. Get a list of all services running and the dir which the file is located in, since poeple often put their kits somewhere else than %windir%\system32\...
3. Kill all suspicious services and see if windows still works
If yes remove!, not disbale, the services.
4. Goto the dir where the executables for the services were located and make a backup copy of all files if you like. After that rd the whole dir.
5. Goto the folder (if exists) where the executables found in step 1 are located and proceed like step 4. If the executables are located in the system32 dir or windir or something alike open regedit since it is likely that they are just service wrappers. Goto CurrentControlSetup and then to services and check out the entries. It is stated where the actual executable is located and what parameters are used to start it.
6. Get a decent AV prog, and by decent I don't mean Norton
Hope that helped
Unless someone tells me otherwise.
