Spreading Virus - Printable Version

Spreading Virus - Printable Version

-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: Skype & Technology (/forumdisplay.php?fid=9)
+---- Forum: Skype & Live Messenger (/forumdisplay.php?fid=10)
+----- Thread: Spreading Virus (/showthread.php?tid=94890)

Spreading Virus by lavey92 on 06-29-2010 at 04:29 PM

Hi there (I had Put this in a different forum section as well not sure which one fits its criteria appropriately)

Well I accidentally clicked on a link and it installed a worm or something onto my system and it is constantly sending out links to all my contacts on msn messenger.

the link that my friends are receiving is "h t tp://img..image-bucket.us/imgs/DCSwhd...jpg"

(Made it so you cant click on it)

Can anyone please help me with this, I have used spy-bot search and destroy as well as ESET Nod 32 and they have not detected the virus!

Any help is greatly appreciated!!
Thanks.

RE: Spreading Virus by djdannyp on 06-29-2010 at 06:03 PM

Do the links get sent out when you're signed in? Or when you're offline?

RE: Spreading Virus by lavey92 on 06-29-2010 at 06:08 PM

I'm only aware of whilst signed in.
Thanks

RE: Spreading Virus by Chris4 on 06-29-2010 at 06:35 PM

Go to Start > (in XP click Run) > Type msconfig and press enter. Click the Startup tab.
These are some of the basic processes that run when Windows starts.
Look for any startup items that look suspicious, uncheck them and click OK. Restart your PC when asked.

Once restarted, run Windows Live Messenger and see if the problem continues.

If it does, download AutoRuns. This is a more advanced list and includes everything which runs at startup.
Again, look for anything suspicious which you don't recognise, uncheck them, save, and restart.

If you're unsure about the startup items, you can screenshot[?] them and post it here, we'll take a look.

RE: Spreading Virus by Chrissy on 06-29-2010 at 10:38 PM

Here's what I would do (I know you've done a few).

Start your computer and scan it for Viruses. Please make sure your Anti-Virus software is up to date.

Now scan for malware. (Use: http://www.malwarebytes.org - Free.)
> Make sure you clean all infections.

Change your Windows Live Password & Secret question. (Live Password Change.

Then make sure Windows Live Messenger is set not remember your password.

Restart & Sign-In.

---

Avoid clicking on dodgy link sent by contacts, don't give any personal details to websites that are not live.com. Block checkers and smiley websites than want your password are fake.

Always scan all files received by your contacts, even if your close to them. You can tell if they're telling you about something you did and your WLM ID is in the link.

---

Good Luck

RE: Spreading Virus by lavey92 on 06-30-2010 at 03:51 AM

Thanks for the replies!
Chrissy - I've already run malwarebytes and it was also unsuccessful. I also changed my password and I think it is still sending (Not exactly sure yet). Edit: It is continually sending out said link.

Chris- went into the msconfig startup menu and there were no out of the ordinary autoruns there. So I downloaded the reccomended and theres so much stuff on there that I have no Idea about, so I posted some screenshots here (Sorry if they are too small or too big, tell me and i will host it at photobucket, but this was quicker)

Ok That is all the of the stuff that is in autorun!
Thanks again your help has been very great!

RE: Spreading Virus by Menthix on 06-30-2010 at 09:12 AM

In the first and the last screenshot there is an application from "Malware Farms" which looks suspicious. Make sure you don't just disable the startup entry, but browse to the folder where it's located and delete the file and everything associated with it.

RE: Spreading Virus by lavey92 on 06-30-2010 at 09:18 AM

Ok will do this, I will keep you all informed of my progress!

Thanks!

RE: Spreading Virus by lavey92 on 07-01-2010 at 02:40 AM

I Cannot seem to locate the file within the appdata\roaming, however when I type in hvex.exe into search, it comes up with the file, and I click open file location and it isn't in there. So I attempted to delete the file through the searcher, and it says that it cannot be deleted due to it being used elsewhere. I have closed every application and ended every proccess possible (without affecting windows) and it still doesn't let me delete it. Any suggestions?
Thanks

RE: Spreading Virus by Chris4 on 07-01-2010 at 03:28 AM

quote:
Originally posted by lavey92
it says that it cannot be deleted due to it being used elsewhere

Ok here's what you need to do to delete the file...

Press CTRL+SHIFT+ESC to bring up Task Manager.

On the Processes tab, find explorer.exe and click End Process.

Now go to File > New Task. Enter cmd and press OK. This will bring up the Command Prompt.

In the Command Prompt you need to type cd (standing for change directory) and a space, followed by the folder location of the suspicious file, so C:\users\david\appdata\roaming... (see what the rest of the file's location is in AutoRuns). Then press enter.

The prompt should now say the folder you entered, meaning you're "inside" that folder. You can now type del and a space, followed by the file, to delete it. Optionally, so you know it's worked, add a space and /p on the end which will prompt "Delete (Y/N)?" in which you type y and press enter.

Here's an example of me deleting an example.txt file in my Firefox's AppData:

[Image: examplecmd.png]

Once the file is deleted, in Task Manager you can go to File > New Task, enter explorer and press enter, which will open Windows up again.

RE: Spreading Virus by lavey92 on 07-01-2010 at 08:14 AM

Hi there again
I have run into another problem. I have followed your directions Chris and cmd just can't find the file. Here I'll put up some screen shots up of what I had put in, maybe someone can find an error or something!

Thanks a lot for all your help so far, It's greatly appreciated!
And hopefully we can get rid of this little bugger.

RE: Spreading Virus by Chris4 on 07-01-2010 at 08:20 AM

You need to type:
cd C:\Users\David\AppData\Roaming\
then
del hvex.exe

cd only opens folders/directories. You was trying to open the .exe file with the cd command, which you can't do.

You may also need to end the hvex.exe process if that's in Task Manager.

RE: Spreading Virus by lavey92 on 07-01-2010 at 08:29 AM

It Is continuing to tell me that it is invalid:

Sorry if I'm causing you a headache!
And Chris thanks for the quick replies!

RE: Spreading Virus by Chris4 on 07-01-2010 at 08:34 AM

After you move into C:\Users\David\AppData\Roaming\, enter dir which will list the files in that folder.

It must exist because it's in the folder when you tried to delete it using search, before...

You can also try in Task Manager: File > New Task > Enter C:\Users\David\AppData\Roaming\ and click OK, which will bring up that folder in Windows Explorer. Attempt to delete the file.

If no luck, just untick it from AutoRuns, click the save button, close it and restart your computer; see if the virus continues. Run Anti-Malware to double-check.

quote:
Originally posted by CookieRevised
All in all, using the CMD prompt isn't the best way to tackly this (unless you're fluent in DOS).

Fair enough, was just a method which worked fine for me recently to delete a file which was "being used by another process", so thought I'd give give it a try here. Unlocker does the same thing, like you mentioned.

RE: Spreading Virus by CookieRevised on 07-01-2010 at 08:52 AM

There are many reasons why the cmd method will not work

quote:
Originally posted by Chris4
After you move into C:\Users\David\AppData\Roaming\, enter dir which will list the files in that folder.

If del said the file can't be found then dir will certainly not do any good.

The file might be hidden for starters. (although in that case del should have worked if it was just hidden - though there are other file attributes which might prevent the file from being deleted)...

All in all, using the CMD prompt isn't the best way to tackle this (unless you're fluent in DOS).

----------

Note about AutoRuns:

1) Don't untick an entry if you want to permanently remove it. Instead choose "Delete" from the right-click context menu.
Unticking an entry will simply remove the entry from that registry key, but a backup will still be saved by AutoRuns.

2) "Save" will export the current list, it will not remove any entries at all.

3) Autoruns will only show the entry for the current logged in user. There are also entries for the Administrator for example. You can switch between the user by going to the User menu and selecting the appropiate user. What you remove in one user account might still exist in another user account (eg: admin account).

----------

Note about hvex.exe:

Judging from your screenshots, the hvex.exe tool was made in Visual Basic (it has that typcial default VB form icon). This is a very big indicator of something fishy.

If it is indeed some malware made in VB, chances are very high that it wont be detected by any anti-malware program.

This because such malwares are typcially made by so called script-kiddies and there are 1001 variations of such stuff (and anybody can make it). In fact, it probably doesn't do anything out of the ordinary, code-wise that is. In comparisson: WLM itself does far more "dangerous" and "suspecious" coding stuff. The difference is that WLM doesn't do things you do not want and doesn't try to hide it (ok, bugs set aside

). Hvex.exe probably also doesn't have any virus-like behaviour, which is spreading and infecting other files and people. It simply spams your contacts with links (and tries to infect them indirectly in that way). It is unfortunatly a very common IM-malware method these days...

All in all, it is "normal" that it wont be detected by any anti-malware or anti-virus tools though, unfortunatly.

----------

What you can try instead:

1) Go to your Task Manager and kill every hvex.exe process

2) Ope AutoRuns and find that hvex.exe entry again.

3) Right click on that entry and choose "Jump to"

4) In the Registry Editor which popped up, delete the hvex.exe entry which is shown (right click on it and choose "Delete" or "Remove".)

5) Click on the very top of the registry tree (you can quickly go there by pressing the 'Home' button on your keyboard)

6) Search for any other hvex.exe string in your registry (Press 'CTRL'+'F' to open the Search dialog) and remove every entry you've found.

7) Download and install the tool called Unlocker

8) Open your Windows Search and enter hvex.exe (just like you did here).

9) Right click on the found entries and choose "Unlocker"

10) In the Unlocker dialog, choose "Unlock all" if you can

11) Attempt to remove the files directly from the Windows Search dialog (just like you did here)

12) Uninstall Unlocker again. Or at least, remove the UnlockerAssistant from your Run registry key (you could again use AutoRuns for this) as this is not really needed.

RE: Spreading Virus by lavey92 on 07-01-2010 at 09:15 AM

Thanks Cookie
I Deleted them from the registry, and when I type hvex.exe into the search bar, nothing comes up. However, approximatley a couple minutes later, I did searched it again and they came up. Although this type they didn't have a little picture next to it only a blank sheet (don't know if it matters). Additionally, they could not be right-clicked on, only left clicked.

I went back into the registry editor and the hvex.exe was back in there, so I deleted it and then they were gone from the search bar. I tried this about 3 times and the same thing happened everytime.

It appears to me that it is replicating itself every time it is deleted?
Thanks.

RE: Spreading Virus by CookieRevised on 07-01-2010 at 09:33 AM

This could mean a few things:

A) There is another process monitoring the hvex.exe process. You need to find this other process and kill it first using all the same steps as before.

B) Hvex.exe itself has a way to detect when it gets killed and places a copy of itself somewhere else or starts another process when it is closed.

C) Windows does his (in such cases crappy) method of preserving accidental file removals. I'm no expert in Vista, so I can't help you with that. But it involves turning this auto-backup/restore thing off.

---------

For A and B: you could also try to log in to Windows with an account which is not infected (I hope you can sign in as Administrator) and proceed with all the steps as before. So, reboot your computer and try to log in as Admin.

Or you could use MSCONFIG:

1) In MSCONFIG, go to the 'General' tab and choose 'Selective startup'.

2) Untick 'Load startup items'

3) Click 'OK' and reboot

4) execute all the steps listed in previous post.

5) Make sure you also identify that second monitoring process!! And execute the steps listed in previous post for that process too...

6) Reboot

7) Open MSCONFIG, go to the 'General' tab and choose 'Normal startup'.

8) Click 'OK' and reboot

--

The bottom line is that you need to boot up Windows without starting the hvex.exe process (or that other process).

In fact, this should _always_ be done when you're trying to remove malware though. You should _always_ boot up Windows in such a way that only the essential Windows processes are running and nothing, absolutely nothing, else... In Windows XP for example, you can do this by booting up in Safe Mode.

This is an extremely important step which most people forget to take. Even when scanning for malware it is best to take this step because quite a lot of malware has ways to hide themself from anti-virus programs. But they can't hide themselfs if they are not running.....

RE: Spreading Virus by lavey92 on 07-01-2010 at 09:51 AM

Thanks for the help.
Just to clarify things up, the hvex.exe process isn't listed in the processes tab of the task manager. So if something else is monitoring it, is there something to look out for? Should I post a screen-shot of all my processes?

Thanks

RE: RE: Spreading Virus by CookieRevised on 07-01-2010 at 10:04 AM

quote:
Originally posted by lavey92
Should I post a screen-shot of all my processes?

Absolutely.

But

1) Make sure you enlarge the columns widths so the entire entry names can be seen!!

2) Also enable the columns 'Username' and 'Image Path Name'. You can do this in the menu 'View' > 'Select columns...' (or see here for instructions)

3) Sort the list on 'Username' (click on its column header)

----------

In regards to hvex.exe:

After some quick checking I can say that hvex.exe is a malware for sure. It is created in Visual Basic 6 as I suspected before.

It probably copies itself with random names. But there is one file which it uses which is always the same name: Bff17DCdk0.log

This is one of the files created by hvex.exe. However, it is not a textual log file like the name might let you think, it is actually a DLL file used by hvex.exe (maybe a copy of itself?). So, remove this file too.

hvex.exe also does some things in your Temporary Windows Files (TEMP). Probably copying itself to here in order to monitor itself.

RE: Spreading Virus by lavey92 on 07-01-2010 at 11:28 AM

Thanks for that.
I was fiddling around with unlocker and the registry and I managed to get it to delete. So I will just wait until someone tells me I have sent them a link.

I will keep you guys updated!
And everyone has been a great tonne of help!
xx for you all whether or not its deleted or not!

RE: Spreading Virus by lavey92 on 07-01-2010 at 11:49 AM

Well that was unsuccessfull! Still sending out links.......

Here is a screenshot of my processes:

Also you mentioned deleting that file, I cannot locate it anywhere. Could you perhaps make a guess as to where it could be located?
Thanks!

EDIT: Will perhaps deleting and reinstalling windows live messenger help with the problem?

RE: Spreading Virus by Chris4 on 07-01-2010 at 03:48 PM

quote:
Originally posted by lavey92
EDIT: Will perhaps deleting and reinstalling windows live messenger help with the problem?

~~Sure, worth a try.~~ Thought there might be a chance the virus was inside Messenger's program files, or modified an existing program file, but probably unlikely.

I can't really see anything out of the ordinary, possibly apart from taskeng.exe which is the Task Scheduler. It may be worth going to Start > typing Task Scheduler > enter. See if there's any suspicious tasks.

Process Explorer can be used as an advanced Task Manager, which may help.

Also try my suggestion before of Anti-Malware.

RE: Spreading Virus by Spunky on 07-01-2010 at 10:02 PM

The 1st rundll32.exe seems a bit suspect. No description or path like the other one has... It's also not something that should just be running in the background.

RE: Spreading Virus by CookieRevised on 07-02-2010 at 01:59 AM

quote:
Originally posted by lavey92
Here is a screenshot of my processes:

You're not showing all processes. Click on "Show processes for all users"

quote:
Originally posted by lavey92
Also you mentioned deleting that file, I cannot locate it anywhere. Could you perhaps make a guess as to where it could be located?

Search for it using Windows Search...

Note on using search for stuff like this: make absolutely sure you are searching "all files" and including "system and hidden" files. These settings are _not_ enabled by default. So make sure they are enabled first.

quote:
Originally posted by lavey92
EDIT: Will perhaps deleting and reinstalling windows live messenger help with the problem?

No, it wont help at all.

The malware and WLM are two different programs/processes. The malware probably doesn't care what Messenger is installed either. And by uninstalling WLM you don't uninstall or remove the malware; you wouldn't even touch it. So:

1) You would still be infected if you uninstall WLM. Eventhough the malware might (note: 'might' - because it could be using other ways to send links) stop sending links to your contacts.

Note: since your are infected with this malware on your computer, it might be possible that this malware now also knows your login and password, and even has sent it to some unknown 'hacker'. And because you are infected, it is dead easy for the malware to detect if you have changed your password; it would simply take your latest used login and password you use for signin into Messenger....

2) As soon as you install WLM again, everything will be back like it was before... aka: malware sending links.

RE: Spreading Virus by Gooner Mark on 07-02-2010 at 10:57 PM

Hi, I googled the virus and found this forum so thought it best to join. I'm also having the same problem with the image-bucket issue and I'm really concerned by it - the concept of some hacker having my password(s). I'm not ususally stupid when it comes to these links but I had a dumb moment.

Today, I even passed it onto another contact because while talking to a mate on msn, obviously, I sent him a youtube link and said something like "check out this song" so he assumed the link was safe but the image-bucket link actually fucking took over my youtube link and put its own in! The weird thing was, it still showed up as the normal link on my computer so it took us a minute to realise the problem.

The other thing I noticed is that it only happened with the first link I sent, after that, when I tried to send the link again, it worked fine (When I tried sending it again, I didn't know the previous one had been the ib link). I don't mean to waste your time but I just felt the need to put that story out there as it's probably something msn needs to take care of.

Basically I just joined up in the hope that someone has/will soon work out how to fix it. Sending annoying links to friends on msn is bad enough as it is but the thought of my whole online set-up now being at risk is really concerning me. From what you guys know, does this sound like a proper virus, or malware? Which do you reckon is more serious?

Hope someone can help me clear this up. Cheers.

Edit: I also scanned my machine with McAfee security scan and it found no threats to my computer but obviously something isn't write if links are being tampered with on msn and that sort of thing. Advice much welcomed and much needed. Thanks.

RE: Spreading Virus by CookieRevised on 07-03-2010 at 05:46 AM

Follow all the advise given in this thread from the top.

quote:
Originally posted by Gooner Mark
as it's probably something msn needs to take care of.

MS can't do much about this sort of things other than blocking all outgoing image-bucket links (which many other people might not like). But this doesn't prevent malware from infecting you and doesn't prevent malware using other kind of free image services or url services.

Bottom line is to never download/install stuff you don't know, certainly not stuff you find on random sites or even stuff send my known people via email or IMs.

Configuring your browser correctly and understanding how things work might also help a great deal. eg: a properly configured browser shows you a "execute this file Y/N?" confirmation dialog prior to executing a so called "image". This should alarm you that something isn't right. If the file was truely an image, the image would simply show in your browser, without a "file will be executed" dialog.

RE: Spreading Virus by lavey92 on 07-04-2010 at 10:51 AM

Hi There
Thanks for the replies, sorry I haven't been in touch I have been away for the weekend

Here are all of the processes from all users.

currently making a thorough search for that .log file
will update when it finishes!

RE: Spreading Virus by Chris4 on 07-04-2010 at 11:45 AM

Images aren't working, lavey92. Please upload to a reliable image hosting website such as imgur or imageshack.

Edit: They're working now.

RE: Spreading Virus by lavey92 on 07-06-2010 at 12:37 PM

sorry didnt realise you replied! Here it is!

http://img824.imageshack.us/i/taskman1.jpg/

http://img517.imageshack.us/i/taskman2.jpg/

I havent had much news from my friends via msn about this virus spreading, none of them have said they have recieved it since i got back from my weekend trip.
However, in the search the hvex.exe doesn't come up anymore but when i type in its full previous direction in appdata and roaming, and press enter, the .exe runs itself. So this means it is still there! haha damn thing.

Furthermore, I did thorough searches to find that .log file however no results were found!
Thanks
Dave

RE: Spreading Virus by Chris4 on 07-06-2010 at 12:57 PM

The ThreatExpert report for hvex.exe can be found here:

http://www.threatexpert.com/report.aspx?md5=75049...a68cd607615ff12095

If you've unselected it from startup, checked for the log file and keep trying to use Unlocker and remove the exe, you should be fine for now.

Like I suggested before, Anti-Malware should remove this for you if you're unable to do it manually.

RE: Spreading Virus by CookieRevised on 07-07-2010 at 12:14 AM

quote:
Originally posted by lavey92
However, in the search the hvex.exe doesn't come up anymore but when i type in its full previous direction in appdata and roaming, and press enter, the .exe runs itself.

Erm... did you enter the full path _and_ filename (thus included hvex.exe)????

A program will not start when you simply navigate (or search) for its path. But if you included the file itself and pressed enter, you actually executed the program...

If so, you manually started the virus again and you're probably back to square one and you're infected again.

RE: Spreading Virus by lavey92 on 07-07-2010 at 08:37 AM

It gives me a warning before running it.

I got a full version of malware bytes and it picked it up quickly and it deleted it, now it says that the file does not exist and I havent been sending any links to anybody for the past few days!

So thanks to everybody for your help!
It was greatly Appreciated!

RE: Spreading Virus by Chris4 on 07-07-2010 at 09:06 AM

Glad to hear you removed it finally. (Y)

RE: Spreading Virus by kikojawa on 07-13-2010 at 12:44 AM

lavy .. i got this fucken virus so tell me step by step what i have to do to get rid of it its makes my messenger crazy
plz help

RE: Spreading Virus by Chrissy on 07-13-2010 at 01:12 AM

Get the full version of malware bytes. Scan, and remove all threats

RE: Spreading Virus by lavey92 on 07-13-2010 at 04:46 AM

Please would be nice

Yeah what chrissy said, in the end thats what removed the virus for me completely!

However, after using allot of the stuff that other people posted on this thread managed to stop it from sending links, but the executable still stayed in my system!

So get malwarebytes full version.