[RESOLVED] Why does my antivirus pick up anything VB6 compiles as a trojan?

[David2010]

Ok I purchased Windows Onecare last week and started doing some development with VB6 again but every time I compile ANY program in VB6 my antivirus picks it up a Trojan.

I purchased a legit copy of VB6 a while back and I even tried to uninstall and reinstall VB6 to see if it was just bugged but that didn't help.

What the heck is going on here???

[RhinoBull]

Just any program? What happens if you compile this?

Private Sub Command1_Click()
    MsgBox "Hello World!"
End Sub

[MartinLiss]

Sounds like a problem with OneCare. Have you visited their support site?

[Billy Conner]

about 7-8 years ago this happened to me. my antivirus started going crazy on me (mcafee at the time). every time i compiled an exe or ran anything it stopped me. i thought it broke so i disabled it. when it came time to buy a new pc, i backed up all my vb stuff (including the compiled stuff) and then i started copying it over and norton antivirus said that the compiled exe's were still infected. it sounded to me as if the virus was listening and waiting for exe's to be created or used and it would infect them at that time. now that i think about it which really sounds like something relatively easy to be able to recreate.

Im not saying this is your case (because it sounds like its just detecting the new vb exe's to be trojans not everything), but to be sure something like this isnt happening to you, you could zip a simple executable and scan it on another pc, and/or send it via email to yourself on a site that has its own virus protection so it can scan it for you.

anyway, that my 2¢ on this. good luck to you, i hope its just your WinOc.

[soorya]

What AV software you use ?
I faced similar issue a while back in my friend's pc with VB6 builds.
What trojan name is detected ?

[David2010]

Just any program? What happens if you compile this?

Private Sub Command1_Click()
    MsgBox "Hello World!"
End Sub

Even with a code as simple as that it says its a Trojan.

[David2010]

What AV software you use ?
I faced similar issue a while back in my friend's pc with VB6 builds.
What trojan name is detected ?

As stated in the first post I use Windows Onecare as my antivirus.

It detects it as VLogger. What is VLogger!?!?!?

I googled VLogger Trojan but with no helpful search results.

[David2010]

about 7-8 years ago this happened to me. my antivirus started going crazy on me (mcafee at the time). every time i compiled an exe or ran anything it stopped me. i thought it broke so i disabled it. when it came time to buy a new pc, i backed up all my vb stuff (including the compiled stuff) and then i started copying it over and norton antivirus said that the compiled exe's were still infected. it sounded to me as if the virus was listening and waiting for exe's to be created or used and it would infect them at that time. now that i think about it which really sounds like something relatively easy to be able to recreate.

Im not saying this is your case (because it sounds like its just detecting the new vb exe's to be trojans not everything), but to be sure something like this isnt happening to you, you could zip a simple executable and scan it on another pc, and/or send it via email to yourself on a site that has its own virus protection so it can scan it for you.

anyway, that my 2¢ on this. good luck to you, i hope its just your WinOc.

I scanned it on another computer but it didn't show anything.

I scanned my whole computer and didn't find any programs that would have infected all my VB6's exe's.

I am really stumped here.

[LaVolpe]

David, you may very well have a virus on your machine. Have you considered what Billy Conner recommended, post #4, middle paragraph? If you do test your exe against another anti-virus app and it reports a virus, then I'd have to say that if walks like a duck and talks like a duck, it is probably a duck (or virus in this case).

Edited: Ignore the above, we posted about the same time; you answered the question.

[MartinLiss]

It is apparently a virus. Does OneSource allow you to do manual scans of your PC? If so you might want to see if you're infected.

[David2010]

It is apparently a virus. Does OneSource allow you to do manual scans of your PC? If so you might want to see if you're infected.

Its windows Onecare and yes it does.

But I already scanned my entire computer and it only shows the vb6 exe's are infected.

[AtomSoft]

maybe its a virus made for VB6 itself. And is used to reproduce itself with the vb software. Try reinstalling VB6 and giving it a shot.

[David2010]

David, you may very well have a virus on your machine. Have you considered what Billy Conner recommended, post #4, middle paragraph? If you do test your exe against another anti-virus app and it reports a virus, then I'd have to say that if walks like a duck and talks like a duck, it is probably a duck (or virus in this case).

Edited: Ignore the above, we posted about the same time; you answered the question.

Is it possible for a malicious program to replace the VB6 install executable on the Read-Only CD?

That sure doesn't sound likely. Or possible.

I really am stumped.

I haven't contacted Onecare yet but I don't exactly know what I would say to them or if they would believe me. :-/

[David2010]

maybe its a virus made for VB6 itself. And is used to reproduce itself with the vb software. Try reinstalling VB6 and giving it a shot.

As stated in the first post I said that I already tried that. :-/

[MartinLiss]

Here's a VB-made exe. What happens when you run it?

[David2010]

Is there a program that can tell you exactly what is going on?

If there was I could use it to hopefully track down exactly what goes wrong when I compile a VB6 exe and I could perhaps fix it from there.

[David2010]

Here's a VB-made exe. What happens when you run it?

You didn't attach anything. O.O

[MartinLiss]

Oops. You'll need to unpack this.

[MartinLiss]

You could also try this free trial version of McAfee.

[David2010]

Oops. You'll need to unpack this.

Ha. Funny.

No it didn't show anything.

Perhaps I just have a cruddy Antivirus. :-/

What is VLogger anyways? Is there any background info on it?

I just want to know for sure that it IS an antivirus problem and not a custom Trojan hijacking all my VB6 executables. :-/

[LaVolpe]

You might want to google for it, it may not be a virus, but known spyware. I didn't get any immediate hits on Google.

Regarding free virus apps, I've been using Avast on 3 pcs for the past 6 months or so & like it. It's "Home" addition is free.

[MartinLiss]

A not very helpful site that says it's a trojan.

[David2010]

A not very helpful site that says it's a trojan.

yeah but no info on removing it or what causes it. :-/

[Zach_VB6]

Use Avast! Home AntiVirus, never gave me any problems!

[MartinLiss]

yeah but no info on removing it or what causes it. :-/

That's why I said "not very helpful". Try McAfee or Avast.

[David2010]

Ok here is some pictures that won't help. LOL

[David2010]

That's why I said "not very helpful". Try McAfee or Avast.

Ok... I hate that I purchased an antivirus just so I could get rid of it though. :-/

[LaVolpe]

Some virus' are really nasty. Even though you may be able to clean that one, it could very well popup again from another file. I've had one such virus that even after cleaning, it popped back up in the next reboot, time and time again, it was a sick & frustrating 6 hours I spent on that merry-go-round. Eventually, I caved in, reformatted & reloaded. My son is about to experience the same thing; his pc (not using Avast, using Norton), recently got infected -- Avast is going on his clean install when he finishes. I restricted him from IP access until the reinstall is done

[soorya]

Try Malwarebytes' Anti-Malware its free.
http://www.besttechie.net/tools/mbam-setup.exe

Why don't you try HijackThis.exe
Google and download it.
Run and post the log file, may be I can help you.
Or you can see what are the abnormal progs are running or any new reg entries.

I can understand your state now, which I suffered few weeks back. Malware authors are very very smart now a days. Running trojans on memory without any trace.

[David2010]

Try Malwarebytes' Anti-Malware its free.
http://www.besttechie.net/tools/mbam-setup.exe

Why don't you try HijackThis.exe
Google and download it.
Run and post the log file, may be I can help you.
Or you can see what are the abnormal progs are running or any new reg entries.

I can understand your state now, which I suffered few weeks back. Malware authors are very very smart now a days. Running trojans on memory without any trace.

Ok I downloaded hijackthis and got this report when I scanned.

[soorya]

Have you checked any abnormal reference on your project settings ?
The issue may not with the VB6 build exe.
It can be with any new exe you run getting injected. The important clue is the Project Reference. Can you post your problematic *.vbp file ?

[soorya]

Suspected area:

What is Styler ? If you sure ignore else uninstall it.
C:\Program Files\Styler\Styler.exe

These reg entries are in the RunOnce: so monitor on next boot.

O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')


Search {5C255C8A-E604-49b4-9D64-90988571CECB} in reg and know what it is.
Or take a backup and delete that keys.

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

[David2010]

Have you checked any abnormal reference on your project settings ?
The issue may not with the VB6 build exe.
It can be with any new exe you run getting injected. The important clue is the Project Reference. Can you post your problematic *.vbp file ?

Here.

[soorya]

Clean project... no doubt at all on your settings.
Try my compilation. Zip Password is "gaamaa"

Check the exe size. After the virus injection the new size will be bigger.

Another good test you need to do is.
While compiling, name it as Project1.exx
Keep that Project1.exx ziped and safe.
Rename another copy of it as Project1.exe and compare the size.
Some virus will target only exe extensions. But I think your virus is hooking the VB6.exe and injecting while building. Keep your affected exe in a password protected zip for any future observations.

[soorya]

I think your msvbvm60.dll is currupted.
It won't be killed how ever you reinstall VB6. because its is shared file.

Step1:
Restart the PC in safemode.
Uninstall VB6

Step2:
Delete msvbvm60.dll
C:\WINDOWS\system32
C:\WINDOWS\system32\dllcache

Step3:
Delete all the files from Temp folders.
I hope u know 2 temp folders.
C:\WINDOWS\Temp
Start > Run > %temp%

Step4:
Start > MsConfig > remove suspected StartUp reg entries.
Just untick those, if not sure.

Step5:
Shut down the PC. Remove the Ram and exchage the slots if you have 1+
Restart the PC in normal mode after 3 mins.


Now reinstall the VB6 and try.

[soorya]

Similar Virus:
http://www.virustotal.com/analisis/0...e07-1243830855

You can load your file here:
http://www.virustotal.com/

[Billy Conner]

wouldnt his exe be a different size if he compiles to p-code and you compile to native? there are other options that will effect the size as well? it would be hard to judge this way i believe.

Clean project... no doubt at all on your settings.
Try my compilation. Zip Password is "gaamaa"

Check the exe size. After the virus injection the new size will be bigger.

Another good test you need to do is.
While compiling, name it as Project1.exx
Keep that Project1.exx ziped and safe.
Rename another copy of it as Project1.exe and compare the size.
Some virus will target only exe extensions. But I think your virus is hooking the VB6.exe and injecting while building. Keep your affected exe in a password protected zip for any future observations.

[soorya]

http://alerta-antivirus.red.es/virus....html?cod=8887
use Spanish to English on Google and read this page to remove your virus.

% system% \ regWindowsupdatexptovista.bat
% system% \ SYSTEMTIME-5474596193354
% system% \ SYSTEMTIME-5474596193354 \ csrs.exe
% system% \ SYSTEMTIME-5474596193354 \ security.dat
% system% \ SYSTEMTIME-5474596193354 \ securityreference.dat

Files are in your system and doing the job.

[MartinLiss]

Ok here is some pictures that won't help. LOL

What happens when you click Clean All?

[soorya]

@Billy Conner:
Let us deal only the common native compilation.

Any how I have posted the proper link to remove his virus.