Arse PC Infected

[fish]

Had my main PC infected when running AVG. Anyhow AVG didn't pick it up so I ran AV whihc solved it. There was still internet traffic so installed corporate Norton V10, scanned and no infection.

However realised last night after turning the e-mail scan on there is a worm sntp engine still on somewhere as it was relaying / sending tons of mail. Norton shows no infection.

The PC is off now and three seperate av programs show no infection so I can only assume the smtp is a leftover from the trojan I had.....

I'm tempted just to flatten and rebuild but this will be a big pain in the derrier so open to you guys how do I identify what is sending the mail.....(It's not outlook)

Cheers

[BliarOut]

Download and run a spybot scan on it. Depending on what it is, it could be quick or tricky to track down

[fish]

Cheers

But I've run most anti virus and anti spyware. I'll try again tonight in safe mode and then try the old fashioned way through the reg and run task magr etc

[jimothy]

You have a PC in your Arse? How did it get infected I wonder...

[BliarOut]

Get autoruns from www.sysinternals.com as well. Makes it easier to spot any hidden lurkers. Oh, and HijackThis just for good measure .

[FunkyNige]

fish said:

Cheers But I've run most anti virus and anti spyware. I'll try again tonight in safe mode and then try the old fashioned way through the reg and run task magr etc

Have you tried Ewido? That's got rid of things none of the others could get rid for me before. It's a free trial thing so it'll work OK with loss in functionality for a while.

[Mrs Fish]

James here:

Having removed all privaleges through zone alarm for everything it is hi jackind svchost.exe will do more reading on this...

[Graham]

IMHO, at the end of the day its usually much quicker to trash and rebuild when a pc has gone down this route.... I've spent days trying to fix machines, and even then ended up reinstalling which takes a couple of hours to get everything back together ...
G

[nickjm]

I had the same problem at work yesterday.

It was the Sober.x virus.

Go to the symantec website and download the removal tools and see if that clears it.