Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Hey, I'm running an XP SP3 system with all the latest updates. It seems I have a virus and I'm having a hard time tracking it down.

I have some outbound connections; services.exe connects to some address' port 443 and stays connected while some svchost.exe instances spawn up momentary connections to some addresses' ports 25 and 80.

I've tried to analyze the traffic; port 80 connections don't seem to be HTTP, port 25 connections never make it and I'm guessing 443 is encrypted.

It used to be the case that I had a rogue svchost.exe running (Process Explorer flagged it white and I tracked down the .sys file and deleted it) but right now all my services seem legit. services.exe is running Event Log and Plug and Play but I'm having trouble figuring which instance of svchost.exe is making the connections.

Assuming my system executables have not been tampered with, there shouldn't be that many services which could be persuaded to run a virus' errands, should there? So what should I suspect? Any obvious places to check? Any popular viruses that make these kinds of connections?

I'm not running any AV software and I'm not very fond of specialized rootkit-detection software; they all run on blacklists and heuristics anyway. What I have here is a definite symptom and I'm prepared to go looking for the cause. Any help would be appreciated.

Edit: I just remembered TCPView shows PIDs and tracked down the svchost.exe instances - two rogues I missed running no system services. I have the same thing as before, something that registers a service with a random 8-letter name whose registry key cannot be viewed or altered using conventional registry editing tools. I can fix this again, but if anyone could tell me why it keeps coming back or about the involvement with services.exe I'd be grateful.

Another edit: Now services.exe has gone crazy; it's opening TCP port 80 connections left and right and is actually eating up quite a bit of my bandwidth. What could cause such a behavior?

I found yet another rogue service using an NTFS data stream called svchost.exe:ext.exe (whose name was "FCI" btw) and deleted it, but still no luck with services.exe.

Final edit: I solved my problem the way I described in my answer, with help from the tools @Moab suggested. I'm still interested in how this thing came to infect me in the first place. I'm leaving the question open for a few more days in case someone suggests me some more forensics tools in addition to GMER, Process Explorer, TCPView, etc. or identifies this rootkit.

share|improve this question
add comment

3 Answers 3

up vote 1 down vote accepted

svchost.exe can be used by any software or malware programmed to use it.

I suggest using a rootkit scanner to see if any are present

http://www.gmer.net/

then follow up with MBAM free, install and update the program using the update tab http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html

and SAS http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html

Yes you can suspect services.exe has been patched to be malicious, SFC should detect this and replace the file unless it is being protected by another part of the malware.

share|improve this answer
    
GMER found the same problems - and an SSDT hook to do with a "sply.sys" which I cannot find anywhere - any ideas? –  aib Jul 21 '10 at 23:27
    
same with MBAM, minus sply.sys –  aib Jul 21 '10 at 23:33
    
SAS got stuck scanning its second file, didn't like it much –  aib Jul 21 '10 at 23:35
    
GMER could not remove it? It should show the hidden sply.sys file. You may have to scan/clean the hard drive offline, connected to another PC as an external drive. –  Moab Jul 22 '10 at 21:43
    
It turned out to be Daemon Tools. The thing hooked all the registry functions, yet GMER was just showing two of them. I ended up triggering a crash, getting a kernel memory dump and printing the actual SSDT table. Only things are kernel + DTools + userdump. Looks safe. –  aib Jul 22 '10 at 22:13
show 1 more comment

Save your data, and reload the system. Major Virus infections take longer to remove than to reload the system. Plus you'll never know if you got all of it...

share|improve this answer
    
I'm not a big fan of reinstalling. A lot of programs don't work without a proper install, and it takes too much time to do them all. Luckily, I've been relying on cross platform programs and .zip distributions lately, and my "Program Files Portable" directory has twice as many programs as my "Program Files." Still, I avoid a system reinstall whenever I can. –  aib Jul 22 '10 at 22:16
add comment

UnHackMe and its companion, RegRun Reanimator detected some problems, including the rogue service with the random 8-letter name and an .exe destined to run at startup. When I instructed their boot-time NT program to remove the driver at startup, it renamed the system32\drivers directory (yes, the directory itself) and caused the system to be unbootable, so beware.

I fixed the drivers\ problem with a password recovery Linux boot CD which wasn't designed for the task but quickly succumbed to some minor hacking. (Drop to shell, execute /scripts/disk.sh to mount the partition, then plain old ls/mv.) I will use the same method to delete the files UnHackMe found.

share|improve this answer
    
this seems to have solved my problem –  aib Jul 22 '10 at 1:02
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.