Task Manager does start. I don't see anything out of the ordinary there. All processes are identified. But if I understand correctly, that is one of the hallmarks of a rootkit --the rootkit takes over an actual process and operates under said processes name. That's what makes them so hard to find.
It's not that they necessarily take over a process, but they might rename the original file and install a new one under the same name. Or what they will do is use a name that looks legitimate. For example, one machine that I cleaned up had a service called "tracert" installed. That is a legitimate command line executable, but it doesn't operate as a service. The Task Manager is also not to be completely trusted, as it can be modified to hide a particular process. The "tasklist" command is more reliable.
If you know approximately when the malware was acquired, you can search for files downloaded on that date and time. The windows directory and the windows system32 directory are favorite places to install the trojan downloader file. The downloader will then acquire and install the actual backdoor. From your description, this malware spreads over the Local Area Network (LAN). Therefore, it is important that you disconnect machines that you are going to clean up from the network, and not reconnect them until you are sure that all machines have been disinfected.
The Microsoft search engine is not particularly good at finding files because it tends to hide files that Microsoft figures you don't need to know about. But you can configure it to find most files (executables in particular). I use Agent Ransack, but at this point you may not be able to reliably install anything.
J.A. Coutts
