Results 1 to 7 of 7

Thread: Possibly a virus

  1. Nov 12th, 2003, 02:21 PM #1
    Sathyaish
    Sathyaish is offline

    Thread Starter
    Fanatic Member
    Join Date
    Feb 2003
    Location
    C:\Windows\Microsoft.NET\Framework
    Posts
    574

    Possibly a virus

    Since the last few hours, I see a Visual Basic form with a plain textbox in it displaying the text "hi" pop up on my screen every few minutes. If I close it, it terminates. It also starts as soon as I restart my system. When I Ctrl+Alt+Del, the form disappears and neither is the process displayed in any of the two tabs of the Task Manager. I checked msconfig, AutoExec.bat and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run as well as HKEY_LOCAL_MACHINE\...\RunOnce as well as RunOnceEx and the entries all seem normal. Have anyone of you had a similar problem. Is this some new virus? Virus it is I am sure, but what do I do?
    Reply With Quote Reply With Quote
  2. Nov 12th, 2003, 02:33 PM #2
    plenderj
    plenderj is offline
    Retired VBF Adm1nistrator plenderj's Avatar
    Join Date
    Jan 2001
    Location
    Dublin, Ireland
    Posts
    10,359
    Use filemon (www.sysinternals.com) and check if its doing anything.
    Also perform a virus scan using the online scanner (http://securityresponse.symantec.com), or download McAfee ASAP evaluation (www.mcafeeasap.com) and scan for viruses.
    Microsoft MVP : Visual Developer - Visual Basic [2004-2005]
    Reply With Quote Reply With Quote
  3. Nov 12th, 2003, 03:20 PM #3
    Sathyaish
    Sathyaish is offline

    Thread Starter
    Fanatic Member
    Join Date
    Feb 2003
    Location
    C:\Windows\Microsoft.NET\Framework
    Posts
    574
    Thanks! I downloaded the File Monitor (FileMon) from SysInternals site to see what this VB form (a virus in disguise) was doing. It is actually an EXE called msmdsrv.exe.1024 (and this number keeps changing) that's inside C:\Program Files\Microsoft Analysis Service (huh!)\Bin\. Here it writes to an MDB file called msmdqlog.mdb. It keeps opening and reading files and writing something after every few files to this database.

    What do I do? How do I find the anti-virus for this? I already have McAfee running on my system and also NetSheild. What do I download from where to fix this?
    Reply With Quote Reply With Quote
  4. Nov 12th, 2003, 03:39 PM #4
    MartinLiss
    MartinLiss is offline
    Former Admin/Moderator MartinLiss's Avatar
    Join Date
    Sep 1999
    Location
    San Jose, CA
    Posts
    33,431
    Try asking your question at AntiOnline.
    Tips, Examples & Tutorials:
    A valuable forum tool • Generate unique TreeView keys • TreeView with "open" and "closed folder" icons • Time code using GetTickCount • How to trap the Tab key • Scroll a form • NumberBox ActiveX control • Color a ListView row • An InputBox form • How to use SaveSetting and GetSetting • A program registration scheme • Spellcheck a Textbox • Resize controls • Open Windows Explorer at Last Visited Path • A Blackjack Game • Count lines of code • Private Message Viewer • Copy/Paste VB Code • Paste VB Code Add-In • Insert Procedure Names Add-In • A calculator for the game of Spider • My review of REALbasic 2008 • VB6 Debug Tutorial • Picture/Video Viewer • VBF Photo Contest Winners


    2009 - 2016
    Reply With Quote Reply With Quote
  6. Nov 12th, 2003, 03:56 PM #5
    plenderj
    plenderj is offline
    Retired VBF Adm1nistrator plenderj's Avatar
    Join Date
    Jan 2001
    Location
    Dublin, Ireland
    Posts
    10,359
    Actually it doesn't seem like a virus to me :
    http://www.google.com/search?num=30&...rvice+msmdqlog

    Are you sure the VB app popping up a MsgBox is that same service?
    Next time it pops up, go into task manager while the MsgBox is still there and see if its listed under applications.
    Otherwise see if its listed under processes...
    Microsoft MVP : Visual Developer - Visual Basic [2004-2005]
    Reply With Quote Reply With Quote
  7. Nov 13th, 2003, 12:12 AM #6
    Ideas Man
    Ideas Man is offline
    Frenzied Member Ideas Man's Avatar
    Join Date
    Aug 2002
    Location
    Australia
    Posts
    1,718
    If you have Windows XP or 2000, you could also check the services and see if it's there. Non official ones can usually be spotted by not having a description next to their name.
    Reply With Quote Reply With Quote
  8. Nov 14th, 2003, 07:12 AM #7
    abhijit
    abhijit is offline
    PowerPoster abhijit's Avatar
    Join Date
    Jun 1999
    Location
    Chit Chat Forum.
    Posts
    3,228
    Sounds like one of those prank programs.

    Cheers!
    Abhijit
    Everything that has a computer in will fail. Everything in your life, from a watch to a car to, you know, a radio, to an iPhone, it will fail if it has a computer in it. They should kill the people who made those things.- 'Woz'
    save a blobFileStreamDataTable To Text Filemy blog
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules


Click Here to Expand Forum to Full Width