Member Avatar for singularity

Last week, I started having problems with my DSL connection. It would slow down to a crawl at times and then work normally at other times. After looking at my netstats, I found the reason why: unbeknownst to me, my computer was connecting out to about 20 different SMTP servers. The executable responsible for all those connections was services.exe. After I blocked services.exe in ZoneAlarm, my internet connection went back to normal. However, I would like to get rid of the trojan that's doing it. Norton Anti-Virus, AdAware, Spybot S&D, HJT, and a slew of other scanners have all come up empty. My HJT log is below. Has anyone come across this problem before and know how to get rid of it?

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:43:18 PM, on 2/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\ZoneLabs\vsmon.exe
F:\WINDOWS\system32\spoolsv.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\NavNT\defwatch.exe
F:\Program Files\NavNT\rtvscan.exe
F:\WINDOWS\Mixer.exe
F:\Program Files\NavNT\vptray.exe
F:\Program Files\ZoneAlarm\zlclient.exe
F:\WINDOWS\system32\ctfmon.exe
F:\WINDOWS\System32\nvsvc32.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\Tablet.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\MsgSys.EXE
C:\Program Files\Winamp\winamp.exe
F:\Program Files\Trillian\trillian.exe
F:\Program Files\Mozilla Firefox\firefox.exe
F:\Documents and Settings\Mike\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [vptray] F:\Program Files\NavNT\vptray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "F:\Program Files\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) -
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37610.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) -
O23 - Service: DefWatch - Symantec Corporation - F:\Program Files\NavNT\defwatch.exe
O23 - Service: Norton AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - F:\Program Files\NavNT\rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\System32\nvsvc32.exe
O23 - Service: TabletService - Wacom Technology, Corp. - F:\WINDOWS\system32\Tablet.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - F:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 4288 bytes


Thanks in advance.

  • 2 Contributors
  • 3 Replies
  • 209 Views
  • 1 Day Discussion Span
  • Latest Post Latest Post by Michael_Knight

Dani AI

Generated

Brief expert summary: the outbound SMTP traffic tied to services.exe usually means one of two things — a rogue copy of the Service Control Manager executable running from the wrong folder, or a legitimately located services.exe hosting a service or an injected module that is making sockets. Blocking services.exe at the firewall (as did) can stop the symptoms temporarily but also hides the root cause; was correct that blocking a core system process is a risky workaround.

A safe, non-destructive diagnostic sequence:

netstat -ano
netstat -ano | findstr ":25"    (also check :587 and :465)
wmic process where processid=<PID> get ExecutablePath,CommandLine

Map any suspicious PID to its executable path and command line. Inspect that process with Sysinternals Process Explorer (Properties → Image) to view the full path and digital signer. The genuine file lives in C:\WINDOWS\System32\services.exe and is Microsoft-signed.

Verification and cleanup guidance: if the image path is outside System32 or the file is unsigned, treat it as malicious. Use Autoruns to find and remove autostart entries, TCPView to watch live sockets, and perform offline scans (Safe Mode or a rescue/bootable scanner) with up-to-date engines such as Malwarebytes and a reputable rescue ISO. Avoid deleting or replacing services.exe while Windows is running; instead work offline or use sfc /scannow / a repair install to restore authentic system files if needed. Also heed ’s note about multiple real-time products — remove conflicting AVs before deep scans.

Data preservation and final note: image the disk or back up important data before attempting removals. If a full service/process compromise is confirmed, the safest remediation is often an OS rebuild from known-good media.

Recommended Answers

All 3 Replies

Member Avatar for Michael_Knight

It looks like you have 2 Anti Virus programs running, Nortan and Zone Alarm. You should really have only 1 of these.

You should not block services.exe or services.msc as they are system files and management console snap-ins.

Unblock services.exe and unless you use Outlook, Outlook Express or Windows Mail you can safely disable SMTP. To do this...

Press Start > Run and type services.msc then click OK. Look down the list for SMTP. Double click it and set to Manual, then click ok.

If this doesn't stop the problem, then you will have a service running that's causing the problem. You should not stop services from running from the services tab of msconfig either, this only disables it, but the process will still run.

Member Avatar for singularity

SMTP is not in my services list...

Member Avatar for Michael_Knight

OK

Then its possible that you have a program installed that is using a SMTP program or process.

I couldn't see anything in your log that would suggest that though.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.