-
Possibly a virus
Since the last few hours, I see a Visual Basic form with a plain textbox in it displaying the text "hi" pop up on my screen every few minutes. If I close it, it terminates. It also starts as soon as I restart my system. When I Ctrl+Alt+Del, the form disappears and neither is the process displayed in any of the two tabs of the Task Manager. I checked msconfig, AutoExec.bat and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run as well as HKEY_LOCAL_MACHINE\...\RunOnce as well as RunOnceEx and the entries all seem normal. Have anyone of you had a similar problem. Is this some new virus? Virus it is I am sure, but what do I do?
-
Use filemon (www.sysinternals.com) and check if its doing anything.
Also perform a virus scan using the online scanner (http://securityresponse.symantec.com), or download McAfee ASAP evaluation (www.mcafeeasap.com) and scan for viruses.
-
Thanks! I downloaded the File Monitor (FileMon) from SysInternals site to see what this VB form (a virus in disguise) was doing. It is actually an EXE called msmdsrv.exe.1024 (and this number keeps changing) that's inside C:\Program Files\Microsoft Analysis Service (huh!)\Bin\. Here it writes to an MDB file called msmdqlog.mdb. It keeps opening and reading files and writing something after every few files to this database.
What do I do? How do I find the anti-virus for this? I already have McAfee running on my system and also NetSheild. What do I download from where to fix this?
-
Try asking your question at AntiOnline.
-
Actually it doesn't seem like a virus to me :
http://www.google.com/search?num=30&...rvice+msmdqlog
Are you sure the VB app popping up a MsgBox is that same service?
Next time it pops up, go into task manager while the MsgBox is still there and see if its listed under applications.
Otherwise see if its listed under processes...
-
If you have Windows XP or 2000, you could also check the services and see if it's there. Non official ones can usually be spotted by not having a description next to their name.
-
Sounds like one of those prank programs.
Cheers!
Abhijit