hacked mystery emails

Mystery emails have been leaving my computer. My internet service provider has checked the header verified the MAC address etc and states they are definately leaving my computer. I am very security conscious thus surprised.

XP professional , AMD 3800 2GB RAM two harddrives 80gb each. Have broadband 20 Mega download and about 736kbps upload speed.
Connect to the internet via a WRT54G Linksys router. Which has wireless connection disabled. The router has its firewall turned on.
Computer has xp professional with latest patches installed and norton internet security 2008 also having lastest definitions.
I donot download any dodgy files and am very careful so my surprise when these mystery emails with the message QUIT have started leaving my computer and being received by friends who reported it to me.

I have run the a-squared trojan hunter, and trojanhunter 5 after updating them with the latest definitions and nothing has turned up apart from the removal of the trojan UFDLaunch.exe (BHO.259) . I donot think this is the culprit though.

I have run hjack this and below is the output


I am very interested to know what is causing this and would be very grateful for your help.

I use outlook express as my email client and have incoming and outgoing virus scanning turned on.
Use firefox as my browser.

thank you.

Is there any reason why you would be knowingly running a legitimate and active 'Remote Assistance' session:

C:\WINDOWS\system32\sessmgr.exe


If not:

• Go to Control Panel>Windows Firewall.
• Under the "Exceptions" tab, TEMPORARILY uncheck "Remote Assistance" to see if that makes a difference.

Additionally, lets see what the following scan may have to say:

Download SDFix and save it to your Desktop.

Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, a menu with options should appear;
• Select the first option, to run Windows in Safe Mode, then press "Enter".
• Choose your usual account.

• In Safe Mode, right click the SDFix.zip folder and choose Extract All,
• Open the extracted folder and double click RunThis.bat to start the script.
• Type Y to begin the script.
• It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• Your system will take longer that normal to restart as the fixtool will be running and removing files.
• When the desktop loads the Fixtool will complete the removal and display Finished, then press any key to end the script and load your desktop icons.
• Finally open the SDFix folder on your desktop and copy and paste the contents of the results file Report.txt back onto the forum with a new HijackThis log.

__________________
Vincent P

MALWARE: READ FIRST Procedures:
|_ SpyBot V1.5 _|_ HijackThis LOG __V2.0.2 _|

__
ASAP: promoting a high standard and quality of security support no matter where you seek help.

hi,
thank you for your reply.
Is there any reason why you would be knowingly running a legitimate and active 'Remote Assistance' session ?
C:\WINDOWS\system32\sessmgr.exe

I have problems using remote assistance to help my friends thus in computer management ..................users ................. i started the help assistant. but at the moment it is off. but tthe remote desktop help session manager service is on which i started. but still never got the remote assitance to work on this computer.

An update of things I have done so far. will do the other stuff you said shortly thanks for your help.


combifix logs

superantispyware logs

HIJACKTHIS LOG

sdfix report