No Virus found but AVAST shows spam emails being sent!

[bkirkpatrick]

I swallowed a virus and removed all of them per (Avast, Spybot search and destroy, malware bytes, superanitspyware remover). There are no browser redirects or anything like that. However, after the computer comes to life on a restart, my AVAST begins alerting me that spam email is being sent and I can see the email addresses being sent via the Avast notifier (all spam / junk email with unknown sender addresses). The notifier also points to one of the svchost.exe files.

I have done a boot time scan and everything checks out. I had to replace my user32.dll file originally but this is the only thing left. I ran a hijack this log and the only thing it hits on is a windows updater being unknown. I deleted that but it keeps coming back. However hijack this reports it as a neutral item. Don't know if this is part of the problem or not.

 

[bkirkpatrick]

Ran combofix and found:
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\user\Application Data\inst.exe

----- BITS: Possible infected sites -----

hxxp://myimagesafe.com
Infected copy of c:\windows\system32\drivers\ndis.sys was found and disinfected
Restored copy from - The cat ate it

Working so far. My question is how do I block outgoing mail traffic like that in the future.

 

[electronicsfreak]

From what I have researched, those are false positives. Also, be very careful when using combofix. If you want less dangerous malware removal tools, use these below.


Super anti spyware

http://download.cnet.com/SuperAntiSpyware-Free-Edition/3000-8022_4-10523889.html?tag=mncol

Malware Bytes Anti Malware

http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol

CCleaner (actually this is a temp remover but malware installers hide in temp locations many of times)

http://download.cnet.com/ccleaner/?tag=mncol

There is a point in wisdom and knowledge that when you reach it, you exceed what is considered possible - Jason Schoon