The other day I encountered a fairly nasty virus infection - of the more resilient sort.
I had just installed a new power supply (I fancied green LEDs rather than blue for a change, and a quieter fan), and rebooted. I hoped that the power rating was adequately beefy and that it wouldn’t disagree with my rampant overclocking, and indeed, all seemed well.
But… lurking beneath the surface, things were afoot. Initial bootup was fine, but when the desktop was settled, a curious dialogue box appeared. To all intents and purposes it was a Windows Firewall box, and I was surprised by it, but not suspicious. Something along the lines of:
“Windows Firewall Alert: Trojan Zlob.G found”
Unblock | Keep Blocking | Enable Protection”
with a link in the lower portion to get ‘further information’.
Now, I’ve seen the likes of Antivirus 2009 and such, and their fake dialog boxes that fool a heck of a lot of people, but the weird system tray icon and notifications are a dead giveaway to those of us who spend far too long gazing at them as part of our daily grind. This one however, looked utterly, utterly genuine, even down to the item on the taskbar.
However, after I’d clicked on one of the buttons, I paused, and pondered: my suspicions were raised by the fact that Windows Firewall identified it by name - Trojan Zlob.G - as far as I know, it just doesn’t do that, it just lets you know the name of the exe file, and I’ve never seen it ask me to ‘enable protection’ - usually it just asks if you want to block it. It was at this point that I thought it would be wise to disconnect the network cable…
With my curiosity piqued, I ran Sysinternals Process Explorer to get a better idea of running processes and see if anything was amiss, when I noticed an unusually named file that would appear in the process list for a second before vanishing. It wasn’t shutting down, as if I opened a new Process Explorer instance it did the same thing, again, and again.
At this point, I was a little perturbed, as trojans aren’t the friendliest beasts. I tried running scans with AVG, Malware Bytes and the Smitfraud fixer, but apparently there was nothing to be detected.
Even booting into Safe Mode and scanning from there had no effect, although the virus didn’t actually appear to load in Safe Mode, nothing could actually find it.
I rebooted, and tried to extract a little more information about the running process. Fairly secure in the knowledge that with no network cable, it couldn’t actually send anything to the Russian Mafia or whoever actually deploys these things.
One thing I found odd, was the behaviour of Malware Bytes (the best antivirus/spyware program of late in my experience) which was unable to get any updates (in the brief interlude before the cable was yanked I checked for an update). Not even downloading the updates from a laptop and applying them separately had any effect. Most peculiar, and it also had me convinced that something was indeed inside my machine, and that it was a cunning, wily little bugger. The majority of virii that I come across on customers machines wave a white flag at AVG or Malware Bytes, but this one had the appearance of a more sophisticated variety that was actually attempting to block the antivirus software.
At my wits end now, I ran the Smitfraud fix - a handy multipurpose virus basher, which also found nothing. However, the log file for the fix did manage to log the path to this oddly named exe file that momentarily appeared in Process Explorer, giving me the first real bit of information to track it down.
It was lurking in C:\>Documents and Settings\[username]\ApplicationData\Google\
together with an oddly named dll file: spcffwl.dll
So, I attempted to look there, and after much faffing during which point explorer.exe would repeatedly crash, I set the explorer view options to list for all folders, which allowed me to get into the folder without crashing explorer.
Naturally, I tried to delete them! But of course, it’s not that easy. Thinking to cripple the exe which might be trying to prevent me deleting it I tried first unregistering the dll with regsrv32 -u, but as was becoming expected, I had no joy.
At this point (simultaneously browsing on a laptop) I stumbled across a link discussing deleting locked files, with reference to a program called Unlocker. Stuck that on a USB stick and installed it on the infected PC, and tried to unlock the file - still nothing! Gah!
In a moment of desperation/inspiration I tried renaming it, which worked! It might not have had any bearing, or be strictly necessary, but it gave me a sense that there was a chink in it’s armour. So, I rebooted again, theorising that the renamed dll would confuse the exe enough to become effectively inoperative. Then back to the offending folder, and from the context menu I picked Unlocker - a new window came up with several options, one being Delete. I clicked that - and it reported that it couldn’t do that, but… it prompted me to let it delete it on the next reboot.
Yet another reboot, and the exe file was gone!! The dll was still there, but seemingly inert without the exe file trying to prevent it’s deletion. Deleted it, after making a password protected archive of the dll (all that was left of it at this point) to submit to any antivirus people if they wanted it.
Anyway - another reboot later it seemed that it had indeed gone. Malware Bytes successfully updated, which was a good sign. AVG did it’s thing for a few hours, and the PC has had no further problems - it didn’t detect anything by that point, but I presume that’s because I’ve successfully eliminated it by hand.
And now, with my PC back up and running happily, I thought I’d add this to my fresh and shiny blog in case someone else out there finds this info useful in getting rid of this stubborn nuisance (hence the long winded description)! Read More »
Comments (No responses yet)