Unwanted SMTP connections from services.exe slowing internet connection

It's not a long term fix, but you could use a personal firewall, or maybe even the windows firewall to block port 25 so that you can at least stop being their little relay buddy.

Try root kit revealer (formerly a sysinternals and now a MS product)

http://www.microsoft.com/technet/sysinternals/Utilities/RootkitRevealer.mspx

Jared, this is all I gleaned from RootkitRevealer:

HKU\S-1-5-21-1606980848-2111687655-725345543-1004\Software\Adobe\MediaBrowser\MRU\Photoshop\ApplicationPath      12/6/2007 12:23 AM      81 bytes      Data mismatch between Windows API and raw hive data.
HKU\S-1-5-21-1606980848-2111687655-725345543-1004\Software\SecuROM\!CAUTION! NEVER DELETE OR CHANGE ANY KEY*      9/27/2007 6:08 PM      0 bytes      Key name contains embedded nulls (*)
HKU\S-1-5-21-1606980848-2111687655-725345543-1004\Software\Valve\Steam\Steam.exe\UpTimeMostRecent      12/9/2007 6:46 PM      4 bytes      Data mismatch between Windows API and raw hive data.
HKLM\SECURITY\Policy\Secrets\SAC*      2/18/2007 5:02 PM      0 bytes      Key name contains embedded nulls (*)
HKLM\SECURITY\Policy\Secrets\SAI*      2/18/2007 5:02 PM      0 bytes      Key name contains embedded nulls (*)
HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg      2/25/2007 3:03 PM      0 bytes      Access is denied.
HKLM\SYSTEM\ControlSet001\Services\xpdx      11/22/2007 5:40 PM      0 bytes      Hidden from Windows API.
HKLM\SYSTEM\ControlSet003\Services\xpdx      11/22/2007 5:40 PM      0 bytes      Hidden from Windows API.

I'm not sure if that helps. I know I need to find the file(s) involved in sending the smtp packets. It does say they originated from services.exe, which I cannot terminate because it is a "critical process." Isn't "services.exe" just a mask for whatever is causing trouble to hide behind?

It's hard to say.  Malware can use legit files to do it's evil bidding.

Have you used HiJackThis at all?

You can download it from here:

http://www.hijackthis.de/

Run it and save a log file.  Then copy and paste the text file into the place provided.  Check out the results and check any nasty entries.

You can also paste your log into the analyzer here for a second opinion

http://hjt.networktechs.com/

You can also use Process Explorer to look and see the location of services.exe that has been executed and is running.

If it's anywhere other than c:\windows\system32 then it's not the legit one.

http://www.microsoft.com/technet/sysinternals/utilities/processexplorer.mspx

With Process Explorer I confirmed that services.exe is running from C:\WINDOWS\system32\.  I see a bunch of svchost.exe processes in the services.exe process tree. The rest can be identified as legitimate. Could these be causing the problem?

Here is my HiJack This log:

Logfile of HijackThis v1.99.1
Scan saved at 8:10:17 PM, on 12/9/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\RobDeBob\My Documents\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\NETGEAR\WPNT511\wpnt511.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Documents and Settings\RobDeBob\My Documents\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\RobDeBob\My Documents\My Music\JetAudio\JetAudio.exe
C:\Program Files\Media Player Classic\mplayerc.exe
C:\Documents and Settings\RobDeBob\My Documents\Mozilla Firefox\firefox.exe
C:\Program Files\Steam\Steam.exe
C:\Documents and Settings\RobDeBob\My Documents\mIRC\mirc.exe
C:\Documents and Settings\RobDeBob\Desktop\RootkitRevealer.exe
C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\Process Explorer\procexp.exe
C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\Hijack This\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\FlashGet\jccatch.dll
O2 - BHO: (no name) - {3535E605-3F5F-4BDC-83F7-178B05599444} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\DOCUME~1\RobDeBob\MYDOCU~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {700571DE-6297-4DF1-A8D7-3E7F17C1027A} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E271F4E9-D46E-4C7A-8608-AFDD4A87E582} - (no file)
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\FlashGet\getflash.dll
O3 - Toolbar: FlashGet - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [WPNT511] C:\Program Files\NETGEAR\WPNT511\wpnt511.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AAWTray] C:\Documents and Settings\RobDeBob\My Documents\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O8 - Extra context menu item: &Download All with FlashGet - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\DOCUME~1\RobDeBob\MYDOCU~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\FlashGet\FlashGet.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\RobDeBob\MYDOCU~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\DOCUME~1\RobDeBob\MYDOCU~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1171862869402
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1171862850980
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3BA6DED1-0C23-4015-8FA5-C714FE6E5CF1}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{637EF5AA-CEAF-470F-8544-6C086E38BD46}: NameServer = 192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{3BA6DED1-0C23-4015-8FA5-C714FE6E5CF1}: NameServer = 192.168.1.1
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: vtuuvvu - vtuuvvu.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Documents and Settings\RobDeBob\My Documents\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MSSQL$SONY_MEDIAMGR - Unknown owner - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\Sony Vegas\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: SQLAgent$SONY_MEDIAMGR - Unknown owner - C:\Documents and Settings\RobDeBob\My Documents\Other Stuff\Sony Vegas\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: XBPCT - Sysinternals - www.sysinternals.com - C:\DOCUME~1\RobDeBob\LOCALS~1\Temp\XBPCT.exe

It seems there are a good deal of red entries from the analyzer you referred me to. I'll see if fixing them does anything.

Yea... those unknown BHO's are trouble!

You should get it cleaned up and switch to firefox! :)

I have used Mozilla Firefox for years now. I also had the programs you linked me to, but the analyzer was helpful. Fixing the red entries did nothing to stop the smtp communications, though I still need to restart. Any more suggestions? Thanks for your help.

The last time I got an infestation that I could not identify, I just got another hard drive and re-installed windows.  It's not worth the time or effort to fight these things when you can be up and running faster by just reinstalling fresh.

That way you have the old hard drive in case there is something that you need to retrieve.

I just don't think it's worth the time to "maybe" get it cleaned.

I have too many programs and data to back up to make it worth starting anew without simply ghosting, which defeats the purpose, especially since this is a minor problem that doesn't even warrant action of that magnitude. The main qualm I have is that my ping in online games is higher than I would like, but otherwise my browser and other applications work fine. All I need to do is find the source of the problem and fix it. I was hoping someone here would be able to help me with that since I'm not as learned or experienced.

HOw does it look after using hijackthis to fix the red items and rebooting?

Still plenty of smtp traffic, but all but two of the red entries are gone:

"O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
File Missing
When a file is missing, you should always have HijackThis fix the item.

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)"

I might add that these are recurring entries that don't seem to want to go away. I can't imagine they're the source of the problem, but you're the expert.

It looks like ActiveScan did the trick, but I still need to get rid of everything it detected:


Incident                                                                        Status                        Location                                                                                                                                                                                                                                                        

Spyware:Spyware/Virtumonde                                                      Not disinfected               C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\0JKLM56P\fill[1]                                                                                                                                                    
Spyware:Cookie/Com.com                                                          Not disinfected               C:\Documents and Settings\RobDeBob\Application Data\Mozilla\Firefox\Profiles\tjd1vstb.default\cookies.txt[.com.com/]                                                                                                                                            
Spyware:Cookie/Adrevolver                                                       Not disinfected               C:\Documents and Settings\RobDeBob\Cookies\robdebob@adrevolver[1].txt                                                                                                                                                                                          
Spyware:Cookie/Atlas DMT                                                        Not disinfected               C:\Documents and Settings\RobDeBob\Cookies\robdebob@atdmt[1].txt                                                                                                                                                                                                
Spyware:Cookie/Atlas DMT                                                        Not disinfected               C:\Documents and Settings\RobDeBob\Cookies\robdebob@atdmt[2].txt                                                                                                                                                                                                
Spyware:Cookie/Adrevolver                                                       Not disinfected               C:\Documents and Settings\RobDeBob\Cookies\robdebob@media.adrevolver[3].txt                                                                                                                                                                                    
Virus:Generic Malware                                                           Disinfected                   C:\Documents and Settings\RobDeBob\My Documents\GameSpy Arcade\Services\_common\PortraitLoader.dll                                                                                                                                                              
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\SDFix\apps\Process.exe                                                                                                                                                                                                                                      
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\VundoFix Backups\SDFix.exe[SDFix\apps\Process.exe]                                                                                                                                                                                                          
Spyware:Spyware/Virtumonde                                                      Not disinfected               C:\VundoFix Backups\ssqnljj.dll.bad                                                                                                                                                                                                                            
Potentially unwanted tool:Application/Processor                                 Not disinfected               C:\VundoFix Backups\VirtumundoBeGone.exe                                                                                                                                                                                                                        
Virus:Trj/Lzx32.J                                                               Disinfected                   C:\WINDOWS\system32\xpdx.sys                                                                                                                                                                                                                                    

Sweet... knowing what you are dealing with is the best start.

Try booting up in safe mode and deleting all of those virus files.  Then search the registry or references to the offenders and delete them.

Hopefully that will be enough to break its back.  Often they have some kind of file somewhere else that gets loaded at boot up that will re-infect, but we'll cross our fingers in your case.

I did exactly as you said, and here are my new scans:

Hijack this (red entries):

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O23 - Service: XBPCT - Unknown owner - C:\DOCUME~1\RobDeBob\LOCALS~1\Temp\XBPCT.exe (file missing)

ActiveScan:

Spyware:Cookie/FastClick                                                        Not disinfected               C:\Documents and Settings\RobDeBob\Cookies\robdebob@fastclick[2].txt                                                                                                                                                                                            
Virus:Trj/Lzx32.J                                                               Disinfected                   C:\WINDOWS\system32\xpdx.sys                                                                                                                                                                                                                                    


It looks like ctfmon.exe keeps coming back, as well as xpdx.sys, the trojan (I had trouble deleting this). As I said, AVG, Spybot S&D, and Adaware don't detect any threats. When I rebooted, I ran a netstat -b which to my surprise showed no smtp connections from services.exe. However, they started to appear on a second test a minute or so later. Any chance of quickly ending this, now that we have an idea of the problem, once and for all?

ActiveScan determined xpdx.sys as the culprit, but I had to search around for a program that could vanquish it and whatever other files were propagating its existence. Luckily ComboFix did exactly the trick. Absolutely no problems afterward, and it helped me clean up my PC in the process. Thanks for your help, Jared.

For anyone that views this question in the future: Do everything I did here, but also try running ComboFix.exe, a removal tool. It did wonders for my PC, eliminating the problem in its entirety. Highly recommended.