SpamBot Type Trojan seems to be undeletable.

[Swifty123]

While playing World Of Warcraft I'v noticed some heavy lag within the past few days. This is not normal, but I ignored it thinking maybe my ISP is having problems. Well after a couple days I'v realized it cannot be my ISP.

I ran ethereal to see what was going on and sure enough I captured thousands of packets sending emailing using an SMTP server to spam porn.

I quickly disconnected my Internet connection and waited 20 minutes... I then reconnected to find that the packets had stopped.

I have run the following programs to find this trojan.

NOD32
Ewido
HJT
Sophos
AVG
ATF Cleaner
VundoFix
SmitfraudFix
HaxFix
CWSShredder

None of them detected a trojan... only cookies.

I then came accross a odd DLL file in HJT and Sophos File Monitor also detected activity from the file "c:\windows\system32\fflbffl.dll"
I have also found the registry keys and strings as well.

The activity is almost constant... every 5 to 8 seconds it shows that it is working. Even though it currently is not spamming.

Also, I have noticed that while it spams the emails, it also invites other trojans into my computer. NOD32 Detected this trojans and adware before they could be downloaded and blocked them immediately.

I have attempted to delete the registry files and "c:\windows\system32\fflbffl.dll" File...
I am unable to delete any of the files at all... even with explorer disabled in safemode. The file fflbffl.dll and its registry files seem to be untouchable.

I am getting very frustrated with this program. Please if anyone has any information that is useful to removing this let me know. I do not wish to delete and format my HD. I have another computer at a friend house with linux installed on it. I may have to transfer all my files to that computer as a last stand against this battle.


Logfile of HijackThis v1.99.1
Scan saved at 10:17:19 AM, on 5/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\Mobile Action\Bluetooth Manager\MaBtSh.exe
C:\Program Files\AIM\aim.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe


O1 - Hosts: localhost 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {6349B815-9B40-494B-B2F3-8AD7944CBB6B} - c:\windows\system32\fflbffl.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [MaBtSh] C:\Program Files\Mobile Action\Bluetooth Manager\MaBtSh.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: America Online 8.0 Tray Icon.lnk = C:\Program Files\America Online 8.0\aoltray.exe
O4 - Global Startup: InterCheck Monitor.LNK = C:\Program Files\Sophos SWEEP for NT\ICMON.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework/control/activex/TmHcmsX.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.3.102.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1147104732468
O20 - Winlogon Notify: npaazecn - C:\WINDOWS\SYSTEM32\fflbffl.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sophos Anti-Virus Network (SweepNet) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWNETSUP.EXE
O23 - Service: Sophos Anti-Virus (SWEEPSRV.SYS) - Sophos Plc - C:\Program Files\Sophos SWEEP for NT\SWEEPSRV.SYS


------------------

O2 - BHO: (no name) - {6349B815-9B40-494B-B2F3-8AD7944CBB6B} - c:\windows\system32\fflbffl.dll

O20 - Winlogon Notify: npaazecn - C:\WINDOWS\SYSTEM32\fflbffl.dll

Seems to be randomly generated file names on the install of the trojan.

[Swifty123]

I am also the owner and admin of this windows OS, which is why im baffled I am enable to delete these files...

What even baffles me more is the fact that I cannot find out what program is using C:\WINDOWS\SYSTEM32\fflbffl.dll

I seems to be running as soon as the system boots up. I have tried using programs that delete files on the boot. They still could not delete this file or its registry keys.

It's almost as if this file has become part of the system itself... As if its some sort of virus/trojan hybrid that embeds code into the windows OS and also uses a core file. "C:\WINDOWS\SYSTEM32\fflbffl.dll" But thats just a theory I had, take it as a grain of salt.

I just hope someone knows how to fix this one...

[Rahina Rescue]

Hello Swifty, welcome to the forums :)

I do not recommend that you have more than one anti virus product installed and running on your computer at a time.

The reason for this is that if both products have their automatic (Real-Time) protection switched on, then those products which do not encrypt the virus strings within them can cause other anti virus products to cause "false alarms".

It can also lead to a clash as both products fight for access to files which are opened again this is the resident/automatic protection. In general terms, the two programs may conflict and cause:

1) False Alarms: When the anti virus software tells you that your PC has a virus when it actually doesn't.
2) System Performance Problems: Your system may lock up due to both products attempting to access the same file at the same time.

Therefore please go to add/remove in the control panel and remove either nod32 or Sophos Anti-Virus.

Then, please post a fresh Hijackthis Logfile.

[Swifty123]

I uninstalled sophos and installed Kasperksy Firewall.

I will not post another HJT log because it is the same log minus Sophos entries.

c:\windows\system32\fflbffl.dll

No anti virus has detected this file as a threat, but I know for a fact it is not native to any program that I am welcoming onto my HD.

This a trojan downloader. It is keeping a hole open in my system. I have noticed that It will download 4 others DLL files that "Are deletable in safe mode."

But the file c:\windows\system32\fflbffl.dll is not deletable in safe mode, nor are its registry keys. It seems to be using SVCHost and Explorer to access the file c:\windows\system32\fflbffl.dll. Which then it is undeletable in safe because it is being used by those system files.

As far as I know, anti virus's are nearly useless against trojans that are undocumented.

My firewall has cought connections going out from internet explorer to many different SMTP mail servers.

I have filtered the connections and blocked internet explorer from making such connections on port 25/smtp.

I then uninstalled internet explorer and installed firefox. It seems this trojan cannot take effect on other web browser applications.

But the fact is the file is still there and It's not going away. I have given myself complete owner rights to all files and registry on this system. Still, I am unable to delete the DLL and registry files because they are being accessed by SVCHost and Explorer.exe


How do I stop SVCHost and Explorer.exe from accessing that file?

[Rahina Rescue]

Let's get you cleaned up.

Please do the following:

Step #1

Please download Combofix (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your desktop.

Double click on Combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply
Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Step #2

Download the latest version of Java Runtime Environment (JRE) 6 (http://java.sun.com/javase/downloads/index.jsp)

Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.

Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.

Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.

In your next reply please post Combofix.txt & Hijackthis Logfile.