I have a system that got infected with some kind of rootkit. It infected the svchost.exe and sent out emails on port 25. Virus scan 8.5 blocks the port 25 attempts and viewing active port, i can see the attempts being made.
I used 4 different rootkit scanners to no avail, virusscan 8.5 patch 3 does not pick up the svchost rootkit.
What's more concerning is that i just formatted the machine, re-installed XP Pro, did windows updates, installed virusscan 8.5 patch 3 and immediately it started blocking svchost.exe from sending out port 25 traffic!!!
Basically what happens is:
Active ports sees svchost connecting to a remote IP to download virus,
Virus activates,
Active port shows huge amounts of port 25 traffic.
virus scan flags up that it's deleted c:\windows\system32\driver
s\smtpsvc.
exe
This makes no difference as the machine is still infected because svchost.exe is going mad with port 25.
What is this? and How has it survived a format?
Could it be an MBR rootkit?
Start Free Trial
