Question : Svchost.exe sending out spam; can't stop it!

I used CurrPorts to see that something is using svchost to send spam out on a variety of local ports (though the destination poor is always 25, of course). Services.exe is the starting process, but I can't figure out what is starting the particular threads of svchost that send out the spam. If I kill the svchost instances, they just come up again under different process IDs.

I've run Combofix, MalwareBytes, SuperAntiSpyware, Vipre antivirus, and none of them have removed this thing. I tried Svchost Process Analyzer, but it wasn't able to read any information on the particular threads of svchost that are sending out the spam. HijackThis doesn't detect anything suspicious (when I look at it with the help of hijackthis.de/en).

What can I do to figure out what is using svchost to send out spam?

Answer : Svchost.exe sending out spam; can't stop it!

Get Process Explorer from Microsoft and see exactly which application is sending the email out.

http://download.sysinternals.com/Files/ProcessExplorer.zip

Kill the application, scan the system and clean it.

You could also try HitManPro

32bit
http://dl.surfright.nl/HitmanPro35.exe

64bit
http://dl.surfright.nl/HitmanPro35_x64.exe

Sudeep