quote:
Originally posted by cam92
okay so i dont remember clicking on anything bad to get a virus
You got infected by downloading and executing some dodgy file or clicking on some dodgy link (and then executing the downloaded file) though.
Anyways, there are many variants of such malware.
The one listed by you is a Visual Basic 6.0 program, created on a Vista/Win7 machine, signed by "MattNet" and "Malware Farms"
The creator is called Matt btw.
A quick look at the pseudo code shows it is a variation of the one reported
here.
Anti-Malware from Malwarebytes is reported to be able to remove it. Although, since this seems to be a new variation, the anti-malware program might not detect it or be able to remove it completely (see Threatexpert link below).
-----------
Some reports indicate it creates the following registry key:
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "%AppData%\
hvex.exe"
Where
hvex can be
hvex,
image_001, and other goofy names.
And it creates files here:
%AppData%\
hvex.exe
%Temp%\
MLLklhghDJ.log
eg:
C:\Documents and Settings\
username\Application Data\
hvex.exe
C:\Documents and Settings\
username\Local Settings\Temp\
MLLklhghDJ.log
Where
hvex can be
hvex,
image_001, and other goofy names.
And
MLLklhghDJ can be other random names like
chdkCJLDF6 or
bNNm8jhje7,
BcKeIE1KMJ, etc.
Also note that the log file is not a real log file but actually a DLL file used by the malware.
-----------
I've submitted the file to Threatexpert and this is the report:
http://www.threatexpert.com/report.aspx?md5=234ed...32cf2f4d9bad48fd48
and
http://www.threatexpert.com/report.aspx?md5=f4ec7...6f16e4d035f56fb391
Apparently, it creates even more files and registry entries than I could determine from quickly reading the source.
Make sure you check all of those files and registry entries!
EDIT: WTF? the report has been cut down... It showed far more 'stuff' than it does now
Because of this, I'll attach both full reports (for the original exe file, and the one which is downloaded from the first) to this post instead, see attachment.
EDIT: Other variants:
http://www.threatexpert.com/reports.aspx?find=hvex.exe
-----------
After you've
successfully removed the malware completely, do not forget to change your password and alternative question for your Windows Live ID!!!
/ 
Attachment: 
