Hey, I'm running an XP SP3 system with all the latest updates. It seems I have a virus and I'm having a hard time tracking it down.
I have some outbound connections; services.exe connects to some address' port 443 and stays connected while some svchost.exe instances spawn up momentary connections to some addresses' ports 25 and 80.
I've tried to analyze the traffic; port 80 connections don't seem to be HTTP, port 25 connections never make it and I'm guessing 443 is encrypted.
It used to be the case that I had a rogue svchost.exe running (Process Explorer flagged it white and I tracked down the .sys file and deleted it) but right now all my services seem legit. services.exe is running Event Log and Plug and Play but I'm having trouble figuring which instance of svchost.exe is making the connections.
Assuming my system executables have not been tampered with, there shouldn't be that many services which could be persuaded to run a virus' errands, should there? So what should I suspect? Any obvious places to check? Any popular viruses that make these kinds of connections?
I'm not running any AV software and I'm not very fond of specialized rootkit-detection software; they all run on blacklists and heuristics anyway. What I have here is a definite symptom and I'm prepared to go looking for the cause. Any help would be appreciated.
Edit: I just remembered TCPView shows PIDs and tracked down the svchost.exe instances - two rogues I missed running no system services. I have the same thing as before, something that registers a service with a random 8-letter name whose registry key cannot be viewed or altered using conventional registry editing tools. I can fix this again, but if anyone could tell me why it keeps coming back or about the involvement with services.exe I'd be grateful.
Another edit: Now services.exe has gone crazy; it's opening TCP port 80 connections left and right and is actually eating up quite a bit of my bandwidth. What could cause such a behavior?
I found yet another rogue service using an NTFS data stream called svchost.exe:ext.exe (whose name was "FCI" btw) and deleted it, but still no luck with services.exe.
Final edit: I solved my problem the way I described in my answer, with help from the tools @Moab suggested. I'm still interested in how this thing came to infect me in the first place. I'm leaving the question open for a few more days in case someone suggests me some more forensics tools in addition to GMER, Process Explorer, TCPView, etc. or identifies this rootkit.