*groan*--PLEASE BEWARE OF THIS VIRUS--
mscvhost.exe, huelar.exe and winlogos.exe
...and some pesky rootkit protecting the mscvhost.exe, (a Kernel rootkit I suppose) hiding very well inside the registry.
If you come across a folder with an ".exe" attached to it, (especially when there's only ONE folder and the others are all viruses) DO NOT OPEN THAT FOLDER. IT'S A PANDORA'S BOX. If it's my paranoia working, I'd say I'd reformat that USB or device right away. This is what happened before my laptop took an early retirement:
I'll list the steps so someone will take some moral out of it, or maybe just be AWARE. It's a pain not to be aware.
1. I booted the laptop
2. First thing I checked the accessibility of the task manager & the regedit, something I did out of habit and paranoia after my laptop got infected (4 days ago)
3. They were untainted, so I ran HijackThis and found the ever present "O4: Startup: mscvhost.exe"
4. I had a new program download called "autoruns" by systernals, so I ran that and it also found mscvhost.exe on a folder, but can't friggin delete it.
5. So next task:
I'm finally installing a good Antivirus to settle it all (or so I thought): NORTON ANTIVIRUS 2009
I set it up and had it running to do a FULL SYSTEM SCAN
6. After 5 hours of scanning, it came up with 78 HUELAR.EXE VIRUSES and 1 TROJAN HORSE VIRUS, all under the HIGH risk. It was fully deleted/removed.
7. Then, also out of sheer habit and dependency, I checked HIJACKTHIS. It wouldn't run because the computer said "It was already running." I CAN'T find it on the tray, whatever. Maybe it's under the rug, I don't know. The thing is, it's not there.
Well, I FIGURED it was the AV's fault. You know, 2 AV running at once is a heavy load even to a laptop.
I contented myself instead to checking Autoruns and was not disappointed: as I saw it, the folder virus NO longer existed.
YEHEY, my mind rejoiced. But because I felt uneasy about my dear hijackthis not functioning, I decided to restart the laptop.
8. On reboot, just when it's about to go to the user window, another one opens (like the type when you shut it down without pressing restart from the start button). It revealed that the file WINLOGON can't be opened, is damaged or someone had "accessed denied" it, and the laptop is having a FATAL SYSTEM ERROR. I couldn't get the rest because it was fast, and after that it reboots again. The process goes on and on.
I'm too freaked out to do anything at the moment. I'll content myself to consulting an expert computer technician and rely on him instead.
Edited by crimlair, 10 January 2009 - 05:49 AM.