vIRUS!

179

Jul 7, 2006 at 3:57 PM

Ive got the worst virus ever. Before Getting into it I have some general questions about viruses. 1) Is there like a standard procedure one should follow when one suspects a virus? Some kind of series of steps that will always result in targeting and removing the virus, and works for any virus? See below for what I did. 2) How do companies like McAfee and Symmantec write anti-virus software? How do they release virus update files on a daily basis? Do they have people whose job it is to just go out and try to get infected with new stuff? If so, and I suspect my virus is a new one (since their software didnt find it), can I infect them with the virus so that they know about it, and so that they can fix it for me? 3) How reliable is virus scanning software? If you are running with the latest updates, are you pretty much safe? Or no? Do different virus scanners from different companies find different viruses? Or are they all pretty much on the ball and all pretty much find everything? How do free scanners (eg AVG free) compare to the ones that cost 100$ ? 4) Can any file be a virus, or only files that are designed to be executed? For eg, could a txt file be a virus? Could a mp3 file be a virus? If yes, do you have to actually 'run' the file (double click on it), or do you just have to have the file (download/recieve it), to become infected? 5) Are spyware in a completely different category than viruses? Why cant you find a program that is both a virus scanner and a spyware scanner (and a firewall for that matter)? 6) Are there viruses that cant be cleaned? I know some are harder than others to remove, and sometimes its easier to format and reinstall than to remove a virus. But my question is, can any/all viruses be removed if you have the right tools/knowledge/time? OK so heres the scoop: PRE-INFECTION ------------- Running WinXP Pro SP2, with (pretty close to) the latest windows updates Running AVG-free antivirus software, with the very latest updates HOW I GOT INFECTED ------------------ Chatting away on MSN. Got a message from a friend saying something like "HaHa, is this you?", with a link. Maybe I shouldn't have clicked it, but it was from a buddy so I didnt think twice. A browser popped up with a blank window. A message popped up asking if I wanted to run this file. I definetly shouldnt have clicked it, but I did. The browser closed and a feeling of regret started to set in. SYMPTOMS -------- Seconds after getting the virus, my MSN automatically sent the same message to people in my contact list, sending them the same link. I immediately sent them messags saying "no! its a virus dont click it!", but it was too late and now they hate me. I then unplugged my internet cable, shut down the PC. Later, I started it up again and found the following: -My browser's homepage was set to some wierd antivirus site that Ive never heard of, and obviously dont trust. -I could not browse to any other anti-virus websites. I checked my hosts file and found that about 30 of the most popular antivirus websites were all being redirected to 127.0.0.1 (localhost) -AVG, Regedit, and a bunch of the programs/services available in the control panel are all being messed with. Specifically, if I try to open any of them, they are being shut down automatically about 1 or 2 seconds later. -I dont know what else, probably more. ATTEMPTS TO FIX IT ------------------ Ive been working at it a long time, and have made no progress. Pretty frustrating. First, I removed the bogus entries from my hosts file, but they come back on a restart, same for my browser's homepage. Then I spent a long time researching on the net. I found a lot of people complaining about similar symptoms, but virus names were being thrown around left and right, and I wasnt able to put a name to my virus. I searched a lot of the symantec/MacAfee Virus description pages, and found a lot of similar symptoms, but no virus that fit exactly to mine. For example, one virus (serflog.B) sounded like what I had, except that Symantec said that it added entries to the registry, but I checked my registry (regedit worked in safemode), and didnt find such entries. Another virus sounded like mine, and some guy said he fixed it by deleting certain files, but I could not find those files on my PC. I ran several online virus scanners on my machine. AVG, Panda, Ewode, Symmantec, a few others. All of them found zilch, nothing, nada. I pulled the hard drive out, and put it as a second drive into another computer as a data-only drive. My thinking was that this way the virus would be less likely to interfere with a scan, if it was on a separate drive than the OS and the VirusScanner. (is this thinking correct?). So anyway I put the infected drive into another computer that had an up to date Symantec scanner. Ran a full scan on the drive, found nothing at all. Repeated with AVG, MacAfee, and some other one I forget. Found nothing. Out of desperation, I tried running Adaware incase this thing wasnt technicaly a virus, but rather spyware instead. Adaware found nothing (well, a bunch of cookies, but I know thats not what Im looking for). CURRENT STATUS -------------- The infected drive is still infected. The computer I put it into is still ok. I have NO IDEA what the virus even is, and in my mind that is the first step to removal. Im hoping its a brand new virus, and AVG will come out with a virus update tomorro that will find it. However, a lot of the symptoms I was reading about were from pages 1 year old or more. How come the virus scanners arnt finding this? Is there any way to alert MacAfee or Symantec or whoever, and let them know that this virus should be included in their next update? If there is no way to dothis, there really should. Im out of ideas guys, please help! Thanks.

Shai

Jul 7, 2006 at 4:01 PM

there ya go

Author

179

Jul 7, 2006 at 4:05 PM

Thanks ok I'll try this.
Do you know what virus I have? If so please tell me.
Because as Ive said, Ive tried like 10 virus scanners already.
Do you happen to know that this scanner will fix my problem, or are you only suggesting it because it happens to be your favorite?
Anyway, thanks, Ill try this and report back monday.
Cheers.

126

Jul 7, 2006 at 4:08 PM

Have you scanned it with a spyware scanner? Virii and spyware are completely different and one scanner won't catch one of the other type. Can you run a hijack this log and tell us the results? It does sound like a virus as opposed to spyware but you never know with these things. I would run housecall (see post above) if you can and see if it catches anything. It is possible that you have something that isn't detectable, but highly unlikely given the symptoms of what your computer did. I'd also get zone alarm, it would have notified you that the program was taking over your computer as soon as you clicked run.

You may also want to try running in safe mode and doing a virus and spyware scan again.

Probably the quickest way to tell what you have is to run hijack this and post the log. It should show up somewhere because it's running a dll or exe shutting down your anti-virus stuff and changing your host file.

Shai

Jul 7, 2006 at 4:09 PM

I'm suggesting it because once my home network was infected with a virus that fucked with all the "regular" virus scanners I could think of.

Then I came across Trend Micro. Been my favourite ever since.

EDIT: I'm assuming you've already tried running Lavasoft Ad-Aware, Spybot and Hijack This.

126

Jul 7, 2006 at 4:10 PM

Quote:
Original post by AndreTheGiant
Thanks ok I'll try this.
Do you know what virus I have? If so please tell me.
Because as Ive said, Ive tried like 10 virus scanners already.
Do you happen to know that this scanner will fix my problem, or are you only suggesting it because it happens to be your favorite?
Anyway, thanks, Ill try this and report back monday.
Cheers.

Housecall is the best IMO because it is always updated and can't be manipulated by virii. However, since your host file is corrupt it may be going to a different site, so verify that you are at the correct place when going there.

Shae

Jul 7, 2006 at 4:35 PM

Ok. First you should try booting into safe mode, then running AVG. The component that prevents the programs from running should not start in safe mode. If AVG does not find anything, you can also try Anti-Vir or Advast as well as McAfee Stinger. If these do not solve the virus, then I suggest using google to see if you can find anyone else with the same problem. Of course this should be done from a different computer. You should have automatic updates turned on no matter what really. If that does not work, I seriously suggest reinstalling windows after reformating the drive and chocking it up to a learning experience.

I wish I could help you more.

P.S. You should also give HiJackThis a try. Then post the log on their site and they might be able to identify the virus if it spawns an program.

On another note, this thread probably will be locked. This is a game development forum, not a Tech Support board. You could also try your computer manufacture for support if your computer is still under warentee.

Raghar

Jul 7, 2006 at 4:37 PM

Quote:
Original post by AndreTheGiant
Do you know what virus I have? If so please tell me.

How should he know? It's your computer, you runned file you should NEVER run.

If AVG doesn't recognize that virus, it might be a new one, so you might like to send them original address, and the original file you shouldn't run. Add sufix .virus to the original suffix, so you'd avoid any problems on the other side.

Have you looked what programs are automatically started? Some of them are in registry: run. Use Spybot to remove all strange programs from the startup.

If this little worm is unloaded in safe mode, it's probably rather not that much dangerous. Try to avoid your chat program until there is a solution, and look at the mickerosoft pages (The Redmont ones).

Evil Steve

382

Evil Steve

Jul 7, 2006 at 5:55 PM

Quote:
Original post by AndreTheGiant
1) Is there like a standard procedure one should follow when one suspects a virus? Some kind of series of steps that will always result in targeting and removing the virus, and works for any virus? See below for what I did.

I very much doubt it, but I'm not sure. Disconnecting from the Internet, etc was a good call though.

Quote:
Original post by AndreTheGiant
2) How do companies like McAfee and Symmantec write anti-virus software? How do they release virus update files on a daily basis? Do they have people whose job it is to just go out and try to get infected with new stuff? If so, and I suspect my virus is a new one (since their software didnt find it), can I infect them with the virus so that they know about it, and so that they can fix it for me?

No idea. I presume they have teams of people who's job it is to find viruses, but I don't know how they do this. It might be worthwhile e-mailing them to find out if there's anything they can help you with (Particularly if you own their software, in which case they should help you out)

Quote:
Original post by AndreTheGiant
3) How reliable is virus scanning software? If you are running with the latest updates, are you pretty much safe? Or no? Do different virus scanners from different companies find different viruses? Or are they all pretty much on the ball and all pretty much find everything? How do free scanners (eg AVG free) compare to the ones that cost 100$ ?

Again, not sure. But generally you're pretty safe. If you're an idiot and brown porn and warez all day and download every exe you come across, then you're going to get infected, no matter what. If your antivirus software knows about the virus, it can usually remove it the minute it comes into contact with your system. If not, the virus is free on your system for a while until you get a definitions update. Think of anti-virus software like an immune system. If you get an infection and your immune system knows about it already, it can combat it pretty quickly. If not, then you get damaged until you immune system manages to get some defense (Through the defintions update).
If you have a virus that your software doesn't know about, then it has control of your PC and can do pretty much anything until you remove it.

Quote:
Original post by AndreTheGiant
4) Can any file be a virus, or only files that are designed to be executed? For eg, could a txt file be a virus? Could a mp3 file be a virus? If yes, do you have to actually 'run' the file (double click on it), or do you just have to have the file (download/recieve it), to become infected?

I seem to recall (Although I may be imagining things) a bug in Windows XP or Windows 2000 that caused "security issues" with thumbnails for certain file types. I know that there's a bug in the GDI+ code for older, unpatched versions of windows that let a hacker exploit your PC through an image (It was a defect in MS's JPEG decoding code or something that caused buffer overflows. Someone feel free to correct me / update me on this). A text file is very unlikely to pose any threat, an image file more so, and an executable even more so. Think of it this way: the more complicated the file is to extract, the more things that can go wrong.
If you download a file and never view it (As a thumbnail in explorer, double click on it, whatever), you should be safe. Assuming Explorer or some other program doesn't monitor what you're doing and open the file (Which I presume is what antivirus software does).

Quote:
Original post by AndreTheGiant
5) Are spyware in a completely different category than viruses? Why cant you find a program that is both a virus scanner and a spyware scanner (and a firewall for that matter)?

Viruses are designed to propagate and try to infect other machines, usually while damaging your machine in some way. Spyware doesn't propagate to other machines, and just sits on your PC spying on you and changing the way your use your PC. Generally speaking, Spyware is annoying, and is only on your PC, while viruses are destructive and infect any PC they can.
Companies tend not to sell a virus scanner, spyware scanner and firewall all together for the same reason companies tend not to sell DVD authoring software, music eding software and image editing software together. Although they're all similar, there's a big difference between them. Winamp has pretty much no code that's similar to PowerDVD or Nero's DVD authoring package for instance.

Quote:
Original post by AndreTheGiant
6) Are there viruses that cant be cleaned? I know some are harder than others to remove, and sometimes its easier to format and reinstall than to remove a virus. But my question is, can any/all viruses be removed if you have the right tools/knowledge/time?

In theory, any virus can be removed. It's just a case of wiping out the part(s) of code that's doing the damage. However, there's probably times where removing the virus can leave the PC crippled. But if this is the case your PC was probably completely fubar with the virus anyway.

I think this is the same virus my cousin got, and if so it's not that new at all (He got it about a year ago). Whenever he was online, everyone in his MSN contact list was offered a file with a semi-random name ("Check this.jpg.exe", "Wow.jpg.exe", etc). I can't remember what the type was (I'm assuming .jpg.exe in my examples) though. I'm almost certain it was executable though.
Unfortunatly, I've no idea what it was called (He told me at some point, but I've completely forgotten now), and I was never infected so I didn't experience any of the symptoms.
I'll have a nose around Google and post again if I remember / find out what it was called.

115

Jul 7, 2006 at 9:17 PM

Quote:
1) Is there like a standard procedure one should follow when one suspects a virus? Some kind of series of steps that will always result in targeting and removing the virus, and works for any virus? See below for what I did.

Generally, you follow a cycle of detecting infected components, and attempting to remove them. You continue to go around and around until you're satisfied the infection no longer remains. Unfortunately, the steps involved both in detecting and removing an infection vary, and many viruses take measures to interfere with both.

Quote:
2) How do companies like McAfee and Symmantec write anti-virus software? How do they release virus update files on a daily basis? Do they have people whose job it is to just go out and try to get infected with new stuff? If so, and I suspect my virus is a new one (since their software didnt find it), can I infect them with the virus so that they know about it, and so that they can fix it for me?

Companies would have people in "danger areas" trying to pick up on the latest threats, but also, they'll be relying heavily on submissions from individuals and corporations, and also from forum chatter such as this.

Quote:
3) How reliable is virus scanning software? If you are running with the latest updates, are you pretty much safe? Or no? Do different virus scanners from different companies find different viruses? Or are they all pretty much on the ball and all pretty much find everything? How do free scanners (eg AVG free) compare to the ones that cost 100$ ?

Virus scanning software is reliable if your definitions are up to date, the scanner is installed and working properly, and the virus in question is not so new and obscure they haven't yet added it to their database. Anyone who uses instant messaging or filesharing runs the risk of getting the latest virus before there is a fix for it, and I've encountered infections on several clients machines that could not be detected by comercial scanners until a few days later.

Quote:
4) Can any file be a virus, or only files that are designed to be executed? For eg, could a txt file be a virus? Could a mp3 file be a virus? If yes, do you have to actually 'run' the file (double click on it), or do you just have to have the file (download/recieve it), to become infected?

Any file can contain a virus, if a program that opens it contains a bug or "feature" allowing executable code stored within it to be executed. An executable file such as an exe or pif file obviously merely requires you to run it. Media files such as images however can also contain viruses, which exploit vunerabilities in standard libraries designed to read them.

Quote:
5) Are spyware in a completely different category than viruses? Why cant you find a program that is both a virus scanner and a spyware scanner (and a firewall for that matter)?

Spyware generally operates with a semblance of legality, but suffice to say spyware can generally be thought of as a trojan or worm as far as the end user is concerned. More and more virus scanners nowadays are incorporating spyware into their databases.

Quote:
6) Are there viruses that cant be cleaned? I know some are harder than others to remove, and sometimes its easier to format and reinstall than to remove a virus. But my question is, can any/all viruses be removed if you have the right tools/knowledge/time?

All infections can be removed, given the right tools, knowledge, and time. That said, some viruses may destroy data which cannot be recovered afterwards.

Anyway, here's what I suggest. I gather you've put the hard drive from the infected machine into a clean one. First of all, you must make sure the machine you put it into has all the latest windows updates, and that you have an up to date virus scanner installed, before you access anything on the other drive. Once you've done that, do a full virus scan of the suspect drive. If you don't detect anything with one virus scanner, try another. If it detects anything, post the name of any infections you find here, and the name of the virus scanner you used to detect it.

After you have cleaned all infections you can using commercial packages, you need to pick up the leftovers it missed. Make sure you have "show hidden files and folders", and "Hide protected operating system files" turned off. Open a search window, and point it to the infected drive. Expand "more advanced options", and tick the "search system folders", and "search hidden files and folders" boxes. Enter *.* into the search string, start the search, and leave it for however long it takes it to scan your drive. When it is done, arrange all files by "Date modified". You are looking for all files that have been modified after your machine was infected. Any files that were created or altered by the virus will appear in this list. Trace back to the moment you were infected, and examine any files that appear from that moment on.

This often reveals things such as log files, dll's, and various other components that were created by the infection. In your case, it will be important to determine whether your scanners are actually detecting all the infected components. In perticular, you should be looking for any files that are hidden, or are anywhere in your windows directory. Very few files on your system generally change within a given day, so this is often a very effective means of tracking down stray components. Once you get to this stage, I'll cover what to do next.

trevaaar

Jul 7, 2006 at 9:49 PM

What you have been infected with is known as an IM (instant messaging) worm. There are hundreds of them floating around, but pretty much all of them spread in the way you've described. The easiest way to identify exactly which one you have is to Google the URL the virus is sending out to people.

Virus scanning programs are definitely not all created equal. Some commercial programs wouldn't hold a candle to some of the free ones out there. The way they work is by including a set of 'signatures' by which they identify viruses in their definitions, along with a list of automatic removal instructions. Unfortunately, it's impossible for the antivirus companies to protect against every virus.

Try finding the URL that the virus is telling people to visit and posting it here.

115

Jul 7, 2006 at 10:18 PM

Quote:
Virus scanning programs are definitely not all created equal. Some commercial programs wouldn't hold a candle to some of the free ones out there.

Some commercial packages suck, but I have yet to find a free package I'd trust. Two big ones such as AVG and Avast would not detect viruses in any files but those using a known "infectable" extension, and despite Avast claiming otherwise IIRC, it never detected test infections I threw at it using extensions such as txt. No wonder people say they're "faster", and "use less resources": They're skipping 3/4 of the files on my computer. That's about as useful as a firewall that only protects "vulnerable" ports.

Lode

278

Lode

Jul 8, 2006 at 5:51 AM

Make sure to have your important non executable data files on a separate partition of your harddisk. Then, whenever your windows is screwed up, just format and reinstall its partition. You can also make an image of it after installing all software, then you just put back the image whenever windows is dead. Still check the data partition if it hasn't got part of the virus though.

Trying to remove such a virus can help, but really, it'll leave scars everywhere on the system.

Run_The_Shadows

107

Run_The_Shadows

Jul 8, 2006 at 10:09 AM

Quote:
Original post by Lode
Trying to remove such a virus can help, but really, it'll leave scars everywhere on the system.

Not only that, but once you've been compromised there is no guarantee you'll ever be 'safe' again. Formatting and reinstalling everything is the only way to make sure that you aren't compromised.

115

Jul 8, 2006 at 10:17 AM

Quote:
Original post by Run_The_Shadows
Quote:
Original post by Lode
Trying to remove such a virus can help, but really, it'll leave scars everywhere on the system.

Not only that, but once you've been compromised there is no guarantee you'll ever be 'safe' again. Formatting and reinstalling everything is the only way to make sure that you aren't compromised.

While doing a full format is often a good idea in circumstances like this, you shouldn't do it until you've determined the precise nature of the infection(s).

Author

179

Jul 10, 2006 at 8:17 AM

Shae and ChurchSkiz you both suggested starting in safemode to do a scan, since then the virus wont be interfering with the scan. Recall that Ive put the infected drive into another computer, and am running scans from that computer's clean drive. So Im not even booting off the infected drive, it is strictly a data drive. This is one better than your safe mode suggestion, is it not?

Quote:
Original post by Nemesis2k2
Anyway, here's what I suggest. I gather you've put the hard drive from the infected machine into a clean one. First of all, you must make sure the machine you put it into has all the latest windows updates, and that you have an up to date virus scanner installed, before you access anything on the other drive. Once you've done that, do a full virus scan of the suspect drive. If you don't detect anything with one virus scanner, try another. If it detects anything, post the name of any infections you find here, and the name of the virus scanner you used to detect it.

Ive done the above, and tried 3 different virus scanners, including a few online-only ones. Nothing is ever found.

Quote:
Original post by Run_The_Shadows
Formatting and reinstalling everything is the only way to make sure that you aren't compromised.

In this case, I already have my important stuff backed up, and it would be easy to format and re-install. In fact thats probably what i'll end up doing. Given the amount of time Ive already wasted hunting this virus, I probably could have formatted and reinstalled 5 times by now.
But as I said, I sent this virus to a bunch of my frieds, so if there is a non-formatting-and-reinstalling solution, Id still really like to know it.

Still working on it guys. If I ever get a solution, Ill be sure to post it. Thanks to the moderators for leaving this thread open (someone suggested to close it since this is not a tech support forum). I may not have solved the problem yet, but Im learning a lot about viruses in general.

xstreme2000

Jul 10, 2006 at 8:55 AM

One trick I found with a virus on a mates computer which wouldn't allow taskmanager or regedit to start was to go and make a copy of the regedit & taskmanager executables with completely different names and run them. It seemed the virus was basically killing the task as they started up by name, and a simple rename was enough to start up the apps allowing me to shutdown the virus and remove it from start up. Once this has been done you can get some virus checking software going and try to eradicate it.

However, they might be more clever now, this was about 2yrs back.

knowyourrole

Jul 10, 2006 at 9:19 AM

My friend had an extremely similar virus quite a while ago, which he also got off MSN. Try checking your C: drive, and make sure you can see all hidden files there, on my friends computer there were a load of infected files just sitting in the C: drive.

My advice would be to start up the pc with the infected hard drive, and simply go through every process in the task manager, checking what it is with google, and if it shouldnt be there, killing and deleting it. Usually you can find the cause this way. And if you find the file and it wont let you delete it, then you can try booting into DOS to delete it, or even something as stupid as moving or renaming the file before a restart if it will let you.

Hope that helps some, good luck

Author

179