Problem tracking down virus - services.exe port 443 and svchost.exe ports 25 + 80

Question

Hey, I'm running an XP SP3 system with all the latest updates. It seems I have a virus and I'm having a hard time tracking it down.

I have some outbound connections; services.exe connects to some address' port 443 and stays connected while some svchost.exe instances spawn up momentary connections to some addresses' ports 25 and 80.

I've tried to analyze the traffic; port 80 connections don't seem to be HTTP, port 25 connections never make it and I'm guessing 443 is encrypted.

It used to be the case that I had a rogue svchost.exe running (Process Explorer flagged it white and I tracked down the .sys file and deleted it) but right now all my services seem legit. services.exe is running Event Log and Plug and Play but I'm having trouble figuring which instance of svchost.exe is making the connections.

Assuming my system executables have not been tampered with, there shouldn't be that many services which could be persuaded to run a virus' errands, should there? So what should I suspect? Any obvious places to check? Any popular viruses that make these kinds of connections?

I'm not running any AV software and I'm not very fond of specialized rootkit-detection software; they all run on blacklists and heuristics anyway. What I have here is a definite symptom and I'm prepared to go looking for the cause. Any help would be appreciated.

Edit: I just remembered TCPView shows PIDs and tracked down the svchost.exe instances - two rogues I missed running no system services. I have the same thing as before, something that registers a service with a random 8-letter name whose registry key cannot be viewed or altered using conventional registry editing tools. I can fix this again, but if anyone could tell me why it keeps coming back or about the involvement with services.exe I'd be grateful.

Another edit: Now services.exe has gone crazy; it's opening TCP port 80 connections left and right and is actually eating up quite a bit of my bandwidth. What could cause such a behavior?

I found yet another rogue service using an NTFS data stream called svchost.exe:ext.exe (whose name was "FCI" btw) and deleted it, but still no luck with services.exe.

Final edit: I solved my problem the way I described in my answer, with help from the tools @Moab suggested. I'm still interested in how this thing came to infect me in the first place. I'm leaving the question open for a few more days in case someone suggests me some more forensics tools in addition to GMER, Process Explorer, TCPView, etc. or identifies this rootkit.

Answer 1

svchost.exe can be used by any software or malware programmed to use it.

I suggest using a rootkit scanner to see if any are present

http://www.gmer.net/

then follow up with MBAM free, install and update the program using the update tab http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

and SAS http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html

Yes you can suspect services.exe has been patched to be malicious, SFC should detect this and replace the file unless it is being protected by another part of the malware.

Answer 2

Save your data, and reload the system. Major Virus infections take longer to remove than to reload the system. Plus you'll never know if you got all of it...

Answer 3

UnHackMe and its companion, RegRun Reanimator detected some problems, including the rogue service with the random 8-letter name and an .exe destined to run at startup. When I instructed their boot-time NT program to remove the driver at startup, it renamed the system32\drivers directory (yes, the directory itself) and caused the system to be unbootable, so beware.

I fixed the drivers\ problem with a password recovery Linux boot CD which wasn't designed for the task but quickly succumbed to some minor hacking. (Drop to shell, execute /scripts/disk.sh to mount the partition, then plain old ls/mv.) I will use the same method to delete the files UnHackMe found.