Fight with the Suspicious

Although today is Friday the 13th—yes, Friday, July 13th for the superstitious—this short story is dedicated to them. It actually happened after midnight; it was already the 14th, and it lasted all night and all morning on the 14th.

It had been a long time since this had happened to me—those computer issues that drill into your head, make you feel awful, make you feel like the entire OS is ruined, that nothing works, and what little does work runs poorly. At the same time, it gives you the drive and determination to find the solution and get everything back to normal. The last time I could recall this happening to me was almost two years prior, specifically in September 2005, with the MSN Plus Blue Bar. It was the hardest battle I've had with these pieces of trash that install themselves without authorization and exist only to annoy and cause harm. Back then, completely uninstalling it took me two to three full days; that Bar is extremely difficult to remove, especially when you don't know much about the topic (at least back in those days).

After midnight, someone on MSN asked me to recommend an anti-spyware program in Spanish; they had one in English but had deleted it because they didn't know how to use it (they were referring to Ad-Aware). Without hesitation, I recommended Spybot Search & Destroy: a free, very good program with multiple features, and above all, available in several languages, including Spanish.

Since I had just recommended the program, I decided to open it myself. Confident in my PC's security, I ran it to eliminate any Spyware that might have snuck in, as often happens. The program started running properly, and a few Trackers from known programs began appearing, so I ignored them and didn't pay much attention. Since it kept scanning and nothing new showed up, I got bored and prepared to close it.

Just as I was about to close it, the "suspicious" made itself known. "Suspicious" is a word I find funny; many IT security programs use it. I had read it many times—it seems like a nice little word, but it's used to define harmful programs/files. That's why I used it for the title of this post.

Sure enough, as I was getting ready to close Spybot by canceling the PC scan, a file made an outbound request. The Firewall alerted me, and when I read "hldrrr.exe," the air already told me something was wrong. I closed Spybot, and shortly after, more outbound requests appeared; now they were files with a .exe extension whose names were just five-digit numbers. They were random. Confirmed: something bad was going on.

I have a hunch—possibly wrong—that Spybot's scan somehow "touched" these suspicious files, waking them up and making them reveal themselves. I have no idea how long they had been on the PC or how they got there.

I immediately went to the Google search engine, typed in the file name, and everything pointed to a virus—more specifically, a Worm named Bagle. In reality, it was a variant of it; I'm not entirely sure if it originated from one called Beagle (most likely), but the one I had was a variant, its exact name being Bagle.aj.

Throughout all this, outbound requests kept coming. There were now more suspicious files. I blocked them, but I didn't set the Firewall to "remember" the action, because I needed to know exactly which files were causing the conflict. Since I hadn't written down each one, I was likely to forget them; while they requested access, I kept them in my sights.

Worms were named that way precisely because, in nature, worms are among the few hermaphroditic living beings—they reproduce on their own. The same thing happens with these viruses: the Worm arrives, installs itself on the PC, and automatically sends itself to other PCs using the user's software, usually email clients and instant messaging applications (MSN). It "reassured" me a little to read that this virus was categorized as Low Hazard and Medium Damage. I'm not really sure what parameters they use to define what is Low, Medium, or High. I hope I don't have to suffer future effects of this virus that haven't been discovered yet, but the ones I've already experienced were minor. Other than affecting Spybot and restarting in Safe Mode (which I'll mention later), the PC suffered no further damage.

So I followed a few initial instructions (I have severe doubts as to whether I was infected with more than one variant of the virus). They consisted of deleting the folder created by the virus, named "exefld" (C:\WINDOWS\exefld)—this folder contained the files with random numerical names—and then deleting a registry entry, specifically the "FirstRRRun" folder (HKEY_CURRENT_USER\Software\FirstRRRun). Done. I did it and restarted, very happy to have ended the problem.

That wasn't the case. That's when I realized the folder was recreating itself, and the outbound requests started again. This had taken time, and it felt like I was back at square one.
I started to get worried and read up a bit on the topic. The virus is quite old—it was created in 2005. I started scanning with the antivirus, and it reported that I wasn't infected. I ran Ad-Aware, and it flagged a few Trackers, but nothing more. So why was the folder recreating itself, and why did outbound requests from strange files associated with the virus continue?
During all of this, I had deleted a couple of lines using HijackThis and disabled another pair with Spybot. The latter was a mistake because they belonged to the printer—I realized this after restarting, so I proceeded to enable them again, and to my surprise, Spybot was uninstalled! How was that even possible? The shortcut icons appeared blank, indicating the program wasn't there. I went to the installation folder, and it was there, but the executable files were missing. That was strange. I completely uninstalled it, reinstalled it, and the executable files wouldn't install. A big problem: the program I needed, and I couldn't install it. The virus was doing something to neutralize an anti-spyware tool. It occurred to me to boot into Safe Mode, and—oh surprise!—I pressed F8, and when it tried to enter Safe Mode, it restarted and booted back into normal mode. This last part made me desperate. If I couldn't access Safe Mode, the problem was severe. If by some terrible coincidence the OS failed, the future looked grim for the operating system overall. And if there was one thing I wanted to avoid, it was a full format.

I went online to read a bit more and found a couple of similar cases, but they didn't offer a precise solution. In two of the cases, the outcome wasn't good: unable to access Safe Mode, two people were recommended a solution that wasn't the best. Thank God it didn't cross my mind to execute it, because otherwise, I would have had more than just a headache. If anyone experiences something similar, DO NOT execute the reboot in /SAFEMODE that is often recommended; at least leave it as an absolute last resort.

This situation was exasperating me. Hours were passing, and instead of making progress toward fixing the PC, I kept encountering more obstacles. It didn't matter—a virus couldn't be unbeatable, especially when its threat level was LOW. It had to be crushed into dust.

I began scanning the PC with everything I had at hand; I was going to destroy that damn virus no matter how long it took. So I started by scanning with Arrobas Antispyware, finding nothing more than a couple of Trackers. I ran another HijackThis scan, and nothing suspicious showed up. I had uninstalled Ad-Aware thinking there was an incompatibility with Spybot, which might explain why the latter wouldn't install—flawed logic on my part. I found that I had a program installed named Dr. Alex Anti-Spyware; I ran it, and six bad items popped up (Trojan.Wlogo, Tooso.5, Wurmark.a, Bagle.aj, and W32.Amca), which I deleted. Why did this program detect all of that while the others didn't? Later, while reading, I learned there was a connection between Tooso.5 and Bagle.aj. I had taken a screenshot of this event, but I lost it. I continued cleaning the registry over and over, optimizing it. Then I updated and scanned with A-Squared Free, an excellent program, though with few customizable options for users (at least in the free version, although the latest update brought improvements in that regard). This program found 160 Trackers, which left my eyes wide open since it was the highest number any program had found on my system. The last item, number 161, was not a Tracker—it was the Bagle virus. I immediately proceeded to clean many of them, though not all the Trackers, as some belonged to programs I regularly use. Then I downloaded a tool specifically created to clean this virus made by Symantec, and it came back negative: the virus was gone.

Just when I was feeling satisfied—having done a thorough job cleaning and removing the Malware in question—ready to move on with my tasks, I connected to the internet, feeling very pleased. Suddenly, a file named "rosa.sys" located in a folder called "hidires" requested outbound internet access. Oh no! Not again! It couldn't be. Something was wrong. The antivirus software wasn't detecting any viruses, yet something was preventing Spybot from installing and creating these files that later requested internet access. What was it? Where was it? Why couldn't I see it?

That last question gave me the answer: Why couldn't I see it? There was a possibility that something hidden was operating behind the scenes, causing what I was now lamenting. Indeed, after reading a bit more, I learned about the existence of Rootkits. Although they had existed for a while, I had only read about them once and had never encountered a real case. In a forum reply to a message, I found a recommendation for two programs to detect Rootkits. I downloaded them: AVG Anti-Rootkit Free and BlackLight Rootkit Eliminator. It was with the latter that I found 10 hidden objects. The first time I ran it, I didn't dare do anything; the second time, I renamed the 10 rootkits it found, and that was it—problem solved.

I had sent them to the Recycle Bin, but when I tried to empty them from the Bin, a message popped up: "Do you want to delete the folder C:\WINDOWS?" Haha, that message was scary, and of course, I clicked no. The solution was to open Run, type cmd, and then enter rd /s /q X:\recycler, replacing X with the drive letter. To make it easier beforehand, I went to Recycle Bin Properties, set it to "configure drives independently," and after deleting it, I configured it back. Everything went well.

I was left with only a couple of temporary files that I couldn't delete with Ctrl + E. I downloaded the program FileASSASSIN to neutralize each file and delete them, but it didn't work. Regardless, I was already free of the problem. Spybot installed correctly, I re-enabled the two files I had disabled at the beginning, and now everything is running smoothly.
Attention: If anyone reaches this text through a search engine while experiencing a similar issue with a virus or malware, please seek solutions on specialized websites. Every virus requires a different solution, and each variant of a virus may also require a distinct fix. This text is intended for orientation purposes only.

(Originally published 07/13/2007)