Still a Spammer.

[swestrup]

I've blocked the outgoing port, so no spam is going out, but my machine is still trying to send it. So far, every scan I've made to try and find the malware responsible has failed.

Comments

[thebabynancy.livejournal.com]

is this "my" machine, as in your PC... or your server? which OS are you using there?

[swestrup]

Its my new Windows XP Box. My server is fine.

[pythonian.livejournal.com]

Aha! Well there's your problem right there. Windows XP *is* malware! :-)

[thebabynancy.livejournal.com]

p.s. what is your malware scan of choice?

[swestrup]

I usually rely upon ClamWin, Ad-Aware and Spybot-S&D. For this I've also tried IceSword, AVG Anti-Rootkit, and RootkitRevealer.

[thebabynancy.livejournal.com]

craziness.

you would think utilizing all those - updated - that they would reveal whatever is there.

bonne chance! :D

[kallisti.livejournal.com]

It could be one of the newest rootkits...it actually runs what you think of as your normal session in a virtual machine under the rootkit.

So there is no way that you can detect the rootkit while the machine is running. Boot up a copy of Knoppix and try running ClamAV from it...or put the HD in a USB enclosure and scan it with someone else's machine and the latest rootkit revealer software.

ttyl

[swestrup]

Does Knoppix have ClamAV? I don't remember that. And is there any particular rootkit revealer you'd recommend. There's dozens of them.

[kallisti.livejournal.com]

Latest versions of Knoppix have almost everything...and the DVD Knoppix *does* have everything!

I haven't seen any one good rootkit revealer...grab as many has you can find and try them all. Actually same goes for virus and malware scanners...there are so many versions of both that no one scanner can catch them all.

This is part of the reason that I mostly run Linux!

ttyl

[electorprince.livejournal.com]

Eset's NOD32. It's like having access to the Eye of Horus. I haven't seen anything it can't find, and it autoruns in the background as an active deflector on top of being a scheduled or manual scanner.