[RESOLVED] Why does my antivirus pick up anything VB6 compiles as a trojan?

Ok I purchased Windows Onecare last week and started doing some development with VB6 again but every time I compile ANY program in VB6 my antivirus picks it up a Trojan.

I purchased a legit copy of VB6 a while back and I even tried to uninstall and reinstall VB6 to see if it was just bugged but that didn't help.

What the heck is going on here???

Just any program? What happens if you compile this?

Code:

---

Private Sub Command1_Click()
    MsgBox "Hello World!"
End Sub

---

Sounds like a problem with OneCare. Have you visited their support site?

about 7-8 years ago this happened to me. my antivirus started going crazy on me (mcafee at the time). every time i compiled an exe or ran anything it stopped me. i thought it broke so i disabled it. when it came time to buy a new pc, i backed up all my vb stuff (including the compiled stuff) and then i started copying it over and norton antivirus said that the compiled exe's were still infected. it sounded to me as if the virus was listening and waiting for exe's to be created or used and it would infect them at that time. now that i think about it which really sounds like something relatively easy to be able to recreate.

Im not saying this is your case (because it sounds like its just detecting the new vb exe's to be trojans not everything), but to be sure something like this isnt happening to you, you could zip a simple executable and scan it on another pc, and/or send it via email to yourself on a site that has its own virus protection so it can scan it for you.

anyway, that my 2¢ on this. good luck to you, i hope its just your WinOc.

What AV software you use ?
I faced similar issue a while back in my friend's pc with VB6 builds.
What trojan name is detected ?

Quote:

---

Originally Posted by RhinoBull

Just any program? What happens if you compile this?

Code:

---

Private Sub Command1_Click()
    MsgBox "Hello World!"
End Sub

---

---

Even with a code as simple as that it says its a Trojan.

Quote:

---

Originally Posted by soorya

What AV software you use ?
I faced similar issue a while back in my friend's pc with VB6 builds.
What trojan name is detected ?

---

As stated in the first post I use Windows Onecare as my antivirus.

It detects it as VLogger. What is VLogger!?!?!?

I googled VLogger Trojan but with no helpful search results.

Quote:

---

Originally Posted by Billy Conner

about 7-8 years ago this happened to me. my antivirus started going crazy on me (mcafee at the time). every time i compiled an exe or ran anything it stopped me. i thought it broke so i disabled it. when it came time to buy a new pc, i backed up all my vb stuff (including the compiled stuff) and then i started copying it over and norton antivirus said that the compiled exe's were still infected. it sounded to me as if the virus was listening and waiting for exe's to be created or used and it would infect them at that time. now that i think about it which really sounds like something relatively easy to be able to recreate.

Im not saying this is your case (because it sounds like its just detecting the new vb exe's to be trojans not everything), but to be sure something like this isnt happening to you, you could zip a simple executable and scan it on another pc, and/or send it via email to yourself on a site that has its own virus protection so it can scan it for you.

anyway, that my 2¢ on this. good luck to you, i hope its just your WinOc.

---

I scanned it on another computer but it didn't show anything.

I scanned my whole computer and didn't find any programs that would have infected all my VB6's exe's.

I am really stumped here.

David, you may very well have a virus on your machine. Have you considered what Billy Conner recommended, post #4, middle paragraph? If you do test your exe against another anti-virus app and it reports a virus, then I'd have to say that if walks like a duck and talks like a duck, it is probably a duck (or virus in this case).

Edited: Ignore the above, we posted about the same time; you answered the question.

It is apparently a virus. Does OneSource allow you to do manual scans of your PC? If so you might want to see if you're infected.

Quote:

---

Originally Posted by MartinLiss

It is apparently a virus. Does OneSource allow you to do manual scans of your PC? If so you might want to see if you're infected.

---

Its windows Onecare and yes it does.

But I already scanned my entire computer and it only shows the vb6 exe's are infected.

maybe its a virus made for VB6 itself. And is used to reproduce itself with the vb software. Try reinstalling VB6 and giving it a shot.

Quote:

---

Originally Posted by LaVolpe

David, you may very well have a virus on your machine. Have you considered what Billy Conner recommended, post #4, middle paragraph? If you do test your exe against another anti-virus app and it reports a virus, then I'd have to say that if walks like a duck and talks like a duck, it is probably a duck (or virus in this case).

Edited: Ignore the above, we posted about the same time; you answered the question.

---

Is it possible for a malicious program to replace the VB6 install executable on the Read-Only CD?

That sure doesn't sound likely. Or possible.

I really am stumped.

I haven't contacted Onecare yet but I don't exactly know what I would say to them or if they would believe me. :-/

Quote:

---

Originally Posted by AtomSoft

maybe its a virus made for VB6 itself. And is used to reproduce itself with the vb software. Try reinstalling VB6 and giving it a shot.

---

As stated in the first post I said that I already tried that. :-/

Here's a VB-made exe. What happens when you run it?

Is there a program that can tell you exactly what is going on?

If there was I could use it to hopefully track down exactly what goes wrong when I compile a VB6 exe and I could perhaps fix it from there.

Quote:

---

Originally Posted by MartinLiss

Here's a VB-made exe. What happens when you run it?

---

You didn't attach anything. O.O

Oops. You'll need to unpack this.

You could also try this free trial version of McAfee.

Quote:

---

Originally Posted by MartinLiss

Oops. You'll need to unpack this.

---

Ha. Funny.

No it didn't show anything.

Perhaps I just have a cruddy Antivirus. :-/

What is VLogger anyways? Is there any background info on it?

I just want to know for sure that it IS an antivirus problem and not a custom Trojan hijacking all my VB6 executables. :-/

You might want to google for it, it may not be a virus, but known spyware. I didn't get any immediate hits on Google.

Regarding free virus apps, I've been using Avast on 3 pcs for the past 6 months or so & like it. It's "Home" addition is free.

A not very helpful site that says it's a trojan.

Quote:

---

Originally Posted by MartinLiss

A not very helpful site that says it's a trojan.

---

yeah but no info on removing it or what causes it. :-/

Use Avast! Home AntiVirus, never gave me any problems!

Quote:

---

Originally Posted by David2010

yeah but no info on removing it or what causes it. :-/

---

That's why I said "not very helpful". Try McAfee or Avast.

Ok here is some pictures that won't help. LOL

http://img149.imageshack.us/img149/9269/28469902.jpg

http://img149.imageshack.us/img149/2922/39819952.jpg

Quote:

---

Originally Posted by MartinLiss

That's why I said "not very helpful". Try McAfee or Avast.

---

Ok... I hate that I purchased an antivirus just so I could get rid of it though. :-/

Some virus' are really nasty. Even though you may be able to clean that one, it could very well popup again from another file. I've had one such virus that even after cleaning, it popped back up in the next reboot, time and time again, it was a sick & frustrating 6 hours I spent on that merry-go-round. Eventually, I caved in, reformatted & reloaded. My son is about to experience the same thing; his pc (not using Avast, using Norton), recently got infected -- Avast is going on his clean install when he finishes. I restricted him from IP access until the reinstall is done ;)

Try Malwarebytes' Anti-Malware its free.
http://www.besttechie.net/tools/mbam-setup.exe

Why don't you try HijackThis.exe
Google and download it.
Run and post the log file, may be I can help you.
Or you can see what are the abnormal progs are running or any new reg entries.

I can understand your state now, which I suffered few weeks back. Malware authors are very very smart now a days. Running trojans on memory without any trace.

Quote:

---

Originally Posted by soorya

Try Malwarebytes' Anti-Malware its free.
http://www.besttechie.net/tools/mbam-setup.exe

Why don't you try HijackThis.exe
Google and download it.
Run and post the log file, may be I can help you.
Or you can see what are the abnormal progs are running or any new reg entries.

I can understand your state now, which I suffered few weeks back. Malware authors are very very smart now a days. Running trojans on memory without any trace.

---

Ok I downloaded hijackthis and got this report when I scanned.

Have you checked any abnormal reference on your project settings ?
The issue may not with the VB6 build exe.
It can be with any new exe you run getting injected. The important clue is the Project Reference. Can you post your problematic *.vbp file ?

Suspected area:

What is Styler ? If you sure ignore else uninstall it.
C:\Program Files\Styler\Styler.exe

These reg entries are in the RunOnce: so monitor on next boot.

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')


Search {5C255C8A-E604-49b4-9D64-90988571CECB} in reg and know what it is.
Or take a backup and delete that keys.

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

Quote:

---

Originally Posted by soorya

Have you checked any abnormal reference on your project settings ?
The issue may not with the VB6 build exe.
It can be with any new exe you run getting injected. The important clue is the Project Reference. Can you post your problematic *.vbp file ?

---

Here.

Clean project... no doubt at all on your settings.
Try my compilation. Zip Password is "gaamaa"

Check the exe size. After the virus injection the new size will be bigger.

Another good test you need to do is.
While compiling, name it as Project1.exx
Keep that Project1.exx ziped and safe.
Rename another copy of it as Project1.exe and compare the size.
Some virus will target only exe extensions. But I think your virus is hooking the VB6.exe and injecting while building. Keep your affected exe in a password protected zip for any future observations.

I think your msvbvm60.dll is currupted.
It won't be killed how ever you reinstall VB6. because its is shared file.

Step1:
Restart the PC in safemode.
Uninstall VB6

Step2:
Delete msvbvm60.dll
C:\WINDOWS\system32
C:\WINDOWS\system32\dllcache

Step3:
Delete all the files from Temp folders.
I hope u know 2 temp folders.
C:\WINDOWS\Temp
Start > Run > %temp%

Step4:
Start > MsConfig > remove suspected StartUp reg entries.
Just untick those, if not sure.

Step5:
Shut down the PC. Remove the Ram and exchage the slots if you have 1+
Restart the PC in normal mode after 3 mins.


Now reinstall the VB6 and try.

Similar Virus:
http://www.virustotal.com/analisis/0...e07-1243830855

You can load your file here:
http://www.virustotal.com/

wouldnt his exe be a different size if he compiles to p-code and you compile to native? there are other options that will effect the size as well? it would be hard to judge this way i believe.

Quote:

---

Originally Posted by soorya

Clean project... no doubt at all on your settings.
Try my compilation. Zip Password is "gaamaa"

Check the exe size. After the virus injection the new size will be bigger.

Another good test you need to do is.
While compiling, name it as Project1.exx
Keep that Project1.exx ziped and safe.
Rename another copy of it as Project1.exe and compare the size.
Some virus will target only exe extensions. But I think your virus is hooking the VB6.exe and injecting while building. Keep your affected exe in a password protected zip for any future observations.

---

http://alerta-antivirus.red.es/virus....html?cod=8887
use Spanish to English on Google and read this page to remove your virus.

% system% \ regWindowsupdatexptovista.bat
% system% \ SYSTEMTIME-5474596193354
% system% \ SYSTEMTIME-5474596193354 \ csrs.exe
% system% \ SYSTEMTIME-5474596193354 \ security.dat
% system% \ SYSTEMTIME-5474596193354 \ securityreference.dat

Files are in your system and doing the job.

Quote:

---

Originally Posted by David2010

Ok here is some pictures that won't help. LOL

http://www.vbforums.com/

http://www.vbforums.com/

---

What happens when you click Clean All?

@Billy Conner:
Let us deal only the common native compilation.

Any how I have posted the proper link to remove his virus.

Full name: Keylogger.W32/Vlogger.U
Type: [Keylogger] - Trojan that uses various methods to capture the keystrokes made by the user at the keyboard.
Platform: [W32] - PE Executable (. EXE,. SCR. DLL) that runs on Windows 32 bits: 95, 98, Me, NT, 2000, XP, 2003
Size (bytes): 28,672
Alias: TrojanSpy: Win32/Vlogger.U (Microsoft), PWS-Redneck (McAfee)

When the trojan is run for the first time, it creates the following files:

% system% \ regWindowsupdatexptovista.bat
% system% \ SYSTEMTIME-5474596193354
% system% \ SYSTEMTIME-5474596193354 \ csrs.exe
% system% \ SYSTEMTIME-5474596193354 \ security.dat
% system% \ SYSTEMTIME-5474596193354 \ securityreference.dat
Note:% System% is a variable that refers to the Windows system directory.
The default is C: \ Windows \ System (Windows 95/98/Me), C: \ Winnt \ System32 (Windows NT/2000), or C: \ Windows \ System32 (Windows XP).

It also creates the following entries in the Windows registry:

Key: HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ currentversion \ run \

Value: client server runtime process = c: \ windows \ system32 \ SYSTEMTIME -
5474596193354 \ csrs.exe


Solution
If you use Windows Me, XP or Vista, and knows when the infection occurred, you can use the feature of 'System Restore' to eliminate the virus back to a restore point prior to infection (note that the changes are undone Windows Setup and remove all the executable files you created or downloaded from the date of the restore point). If you have any questions or problems regarding this option please see our guides on Restore in Windows XP or Windows Vista Restoration.

If you are unable to return to a previous restore point or do not work, we recommend that you temporarily turn off System Restore before removing the virus through other means, as it could have created a backup copy of the virus. If you need help see the Disable System Restore in Vista, XP and Me. Then follow these steps to eliminate the virus:

Restart your computer in Safe Mode or Safe Mode. If you do not know how to do this follow the instructions in this manual How to Start your computer in Safe Mode.

With an updated antivirus, locate all copies of the virus on the hard drive of your PC. If you do not have antivirus, visit our Free Antivirus.

Delete the following files:

% system% \ regWindowsupdatexptovista.bat
% system% \ SYSTEMTIME-5474596193354
% system% \ SYSTEMTIME-5474596193354 \ csrs.exe
% system% \ SYSTEMTIME-5474596193354 \ security.dat
% system% \ SYSTEMTIME-5474596193354 \ securityreference.dat
Note:% System% is a variable that refers to the Windows system directory.
The default is C: \ Windows \ System (Windows 95/98/Me), C: \ Winnt \ System32 (Windows NT/2000), or C: \ Windows \ System32 (Windows XP).

Note: Often the antivirus report that 'it can not repair a file' in the case of worms or Trojan horses because there's nothing to fix, simply delete the file.

If you can not repair or delete infected files, it might be because the file is in use by the virus are in progress (based on memory).
In case you can not remove the virus file, you must manually complete the process in execution of the virus. Open Task Manager (press Control + Shift + Esc). In Windows 98 / Me select the name of the process and stop. Windows 2000/XP/Vista, the tab 'Processes' right-click on the process and select' End Process'. Then try deleting or repair the files that were created by the action of the virus. You can get more information in the "Task Manager" on page Delete libraries. DLL or. EXE.

Then we must edit the registry to undo the changes made by the virus. For information about editing the registry can view this guide editing registry. Be very careful when handling the registration. If you modify some keys in the wrong way can leave the system unusable.

Delete the following registry entries:

Key: HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows \ currentversion \ run \

Value: client server runtime process = c: \ windows \ system32 \ SYSTEMTIME -
5474596193354 \ csrs.exe
Delete all temporary files from your computer, including the browser's temporary files, empty the Recycle Bin.

Restart your computer and browse the entire hard drive with an antivirus to ensure the elimination of the virus. If you disable the system restore, remember to re-activate it. Create a restore point, it will be useful to him in case of possible infections or problems in the future.
... in this way the malware is executed at each Windows start.

Not sure if anyone mentioned this yet however best way to get rid of that virus is to reinstall OS.

@RhinoBull:
My system will take 1 week to come back to present state, if I reinstall OS :)
First clean all the virus and then observe the OS behaviour. Later on reinstall OS.

well i brought up the fact it could be a virus, but i didnt say it was. the conversation has moved to looking to clean something that we arent really sure exists on his machine. before trying to remove something that possibly doesnt exist, i have to ask.. has anyone scanned one of his compiled vb exe's yet to confirm it is infected?

Quote:

---

Originally Posted by Billy Conner

has anyone scanned one of his compiled vb exe's yet to confirm it is infected?

---

Don't want to take a risk. I agree that we must conclude there was a virus, before cleaning it.

Ok after an exhausting effort I removed VB6, Onecare, and all the shared librarys. UGH!

I reinstalled Windows Onecare and VB6 and it automatically installed the libraries and It works fine.

I don't exactly know what went wrong but it works now.

I did a scan and it found nothing so I guess it was just buggy. :-/

I guess thats what I get for giving up Linux and going back to Windows. :-(

Thanks!

Quote:

---

Originally Posted by soorya

@RhinoBull:
My system will take 1 week to come back to present state, if I reinstall OS :)
First clean all the virus and then observe the OS behaviour. Later on reinstall OS.

---

Cleaning the virus may take much longer, though...
Don't waste your time - reinstall OS, install all of your programs and ghost it when you done is so you'll have a solid recovery disk.
That's what I would do - I haven't seen any cleanup procedures or utility that actually work 100%, they always leave something behind...

Quote:

---

Originally Posted by David2010

http://www.vbforums.com/

http://www.vbforums.com/

---

That's great news !
Wait and watch after many reboots.
If its buggy, what about this screen shot ?
Did you see the log from your AV SW after full scan ?

Quote:

---

Originally Posted by RhinoBull

Cleaning the virus may take much longer, though...
Don't waste your time - reinstall OS, install all of your programs and ghost it when you done is so you'll have a solid recovery disk.
That's what I would do - I haven't seen any cleanup procedures or utility that actually work 100%, they always leave something behind...

---

I agree !

Quote:

---

Originally Posted by David2010

...I guess thats what I get for giving up Linux and going back to Windows. :-(

Thanks!

---

I didn't mention it since I didn't think it would apply to you, but most of the references for Vlogger refer to it as a Linux trojan. So there:)

Quote:

---

Originally Posted by MartinLiss

I didn't mention it since I didn't think it would apply to you, but most of the references for Vlogger refer to it as a Linux trojan. So there:)

---

Yeah but if it was a linux trojan then it wouldn't work on windows. lol :D

Quote:

---

Originally Posted by soorya

That's great news !
Wait and watch after many reboots.
If its buggy, what about this screen shot ?
Did you see the log from your AV SW after full scan ?

---

No I mean I think the two programs were buggy not the OS.

The Antivirus says the machine is clean.

Quote:

---

Originally Posted by David2010

The Antivirus says the machine is clean.

---

Get yourself a new AV then. ;)