Possibly a virus
Since the last few hours, I see a Visual Basic form with a plain textbox in it displaying the text "hi" pop up on my screen every few minutes. If I close it, it terminates. It also starts as soon as I restart my system. When I Ctrl+Alt+Del, the form disappears and neither is the process displayed in any of the two tabs of the Task Manager. I checked msconfig, AutoExec.bat and HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run as well as HKEY_LOCAL_MACHINE\...\RunOnce as well as RunOnceEx and the entries all seem normal. Have anyone of you had a similar problem. Is this some new virus? Virus it is I am sure, but what do I do?
Is your messenger service running?
Probably a NET SEND message. You can send them to other people too!
Insert half smiley here.
No, the MSN messenger ain't running, neither is the NET SEND service enabled on my system. I checked it with,
Read closer "MSN MESSENGER IS NOT THE SAME THING"
Does this happen if you're not connected to the internet?
> neither is the NET SEND service enabled on my system
>Does this happen if you're not connected to the internet?
>I should follow my own advice.
Yuck! I plugged off the net and it won't budge. It anyway won't budge once its there, no?
I also have McAfee and VSShield from Network Associates running. Yet, it does seem to me to be a new virus.
I downloaded the File Monitor (FileMon) from SysInternals site to see what this VB form (a virus in disguise) was doing. It is actually an EXE called msmdsrv.exe.1024 (and this number keeps changing) that's inside C:\Program Files\Microsoft Analysis Service (huh!)\Bin\. Here it writes to an MDB file called msmdqlog.mdb. It keeps opening and reading files and writing something after every few files to this database.
Go to Control Panel > Scheduled Tasks, or command prompt and run the "at" comand to see if this thing has scheduled itself to run.
No, I don't have any tasks scheduled. What is convincing about it being a virus is that it does not show itself in the Task Managerand as soon as I hit Ctrl+Alt+Del, even before I can see the task manager, the form disappears.
Use CTRL-SHIFT+ESC to bring up Task Manager without going via the Windows Security dialog.
I think I figured it out. It was one harmless quasi-screen saver. It was Project1.scr but interestingly someone had placed it in %System%\ which is C:\Winnt\System32 on my Win2K machine. Why? I still think it was a virus and the screen saver was only a delusive eye-candy from the internal malicious khooker.exe that ran along with it. I believe one mean SOB planted a key logger on my system.
You can try this utility just to rule out messaging...
Just run a free scan using Trend Micro's web site:
i hate this one chick and i want to send her a virus...... but im not very computer literate..... can someone contact me and help me??? thanxs email me back please at xoNewMa8704ox@aol.com or this sc name:)
Jane marie Doe
Fog Creek Home