is this a virus? vbc.exe?

[Maxheadroom]

MSE has started to pick this file up in the last few days and asks me to send a sample off each time my pc starts because its not recognised.

C:\Users\MY PC \AppData\Local\Temp\temp_fMKebUffFwkUuXw\vbc.exe

ive looked about for info on this file but there seems to be a lot of disagreement on wether this a virus or not,
i find it odd that a MS virus scanner wouldnt recognise a file that is supposed to be a process belonging to Microsoft Visual Studio

 

[marsmimar]

As you've already discovered, the legitimate vbc.exe is a file associated with Visual Studio/Visual Basic. The file is usually found in C:\Windows\Microsoft.NET\Framework\v2.0.50727 folder. If you find it anywhere else, please note that vbc.exe could be a virus, trojan, worm, or spyware.

What is Vbc.exe - Fix vbc.exe Errors Microsoft Corporation

Since MSE is questioning its authenticity (probably because it's not following the usual file path) you could try renaming the .exe extension to something else, like .xxe just as an example. Run your computer to see if anything breaks. If something stops working you can always change the extension back to the original .exe.

Rename a file

You could also submit the file to VirusTotal for another opinion. FWIW, the vbc.exe file on my machine (7 Pro x64) is in the folder referenced above.

https://www.virustotal.com/

 

[Maxheadroom]

thanks marsmimar i have renamed the file like youve suggested but if this is a virus its not as simple as just renaming the executive file is it?

i had already done a virustotal scan but it came up with zero out of 43 but it also says its been voted 36 to 6 as being harmful also says the file name is usenet.exe
some comments

This is not a malware : description..............: Visual Basic Command Line Compiler

This file is used by malware (especially Microsoft .NET RAT) to compile and load payload.
----


Indeed. This doesn't show up as malicious in any AV but malware does detect this... This is a threat, look through your windows startup and look for any suspicious file, which you will most likely find.
----

listed in registry as sn0zZ's Bot

The following files have been added to the system:


%APPDATA%\winlogon.exe

%TEMP%\data.dat

%TEMP%\TWQI3P64Z4.exe


The following registry elements have been created:


HKEY_CURRENT_USER\SOFTWARE\VB AND VBA PROGRAM SETTINGS\

HKEY_CURRENT_USER\SOFTWARE\VB AND VBA PROGRAM SETTINGS\INSTALL\

HKEY_CURRENT_USER\SOFTWARE\VB AND VBA PROGRAM SETTINGS\INSTALL\DATE\

HKEY_CURRENT_USER\SOFTWARE\VB AND VBA PROGRAM SETTINGS\SRVID\

HKEY_CURRENT_USER\SOFTWARE\VB AND VBA PROGRAM SETTINGS\SRVID\ID\


The following registry elements have been changed:


HKEY_CURRENT_USER\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN\PUEDBRM = "%APPDATA%\winlogon.exe"

HKEY_CURRENT_USER\SOFTWARE\VB AND VBA PROGRAM SETTINGS\INSTALL\DATE\S62KNP0C3G = June 10, 2010

HKEY_CURRENT_USER\SOFTWARE\VB AND VBA PROGRAM SETTINGS\SRVID\ID\S62KNP0C3G = sn0zZ's Bot

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\DONOTALLOWEXCEPTIONS = 0

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST\%TEMP%\TWQI3P64Z4.EXE = %TEMP%\TWQI3P64Z4.exe:*:Enabled:Windows Messanger

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\SERVICES\SHAREDACCESS\PARAMETERS\FIREWALLPOLICY\STANDARDPROFILE\AUTHORIZEDAPPLICATIONS\LIST\%WINDIR%\MICROSOFT.NET\FRAMEWORK\V2.0.50727\VBC.EXE = %WINDIR%\Microsoft.NET\Framework\v2.0.50727\vbc.exe:*:Enabled:Windows Messanger
#malware
----


ive checked my startup list it all looks normal except for 2 entries

startup item
371384756 and 1827221171

manufacturer
both unknown

command
C:\users\MY PC\Appdata\local\temp\tmp59FB.tmp.exe and
C:\users\MY PC\Appdata\local\temp\tmpC480.tmp.exe

location
both HKCU\SOFTWARE\Microsofft\Windows\CurrentVersion\Run

i have no idea what these are as it gives no information


it seems i should be concerned over this file even though none of the scanners at virustool has picked it up

 

[Layback Bear]

If you have any feeling that your computer could be infected I suggest using this.
http://www.sevenforums.com/tutorials/166445-windows-defender-offline.html

 

[Maxheadroom]

thank you Layback bear, i ran that but it didnt pick up anything, when my pc restarted MSE once again picked up the vbc.exe in AppData\Local\Temp which i figure that it has recreated its self as i had renamed the .exe
having a look in the temp folder ive found another 12 instances of vbc.exe all in folders with names like temp_tFPKODjsvYKwDpI, i went through and renamed all the .exe's
restarted my pc and rechecked the temp folder and found 2 more newley created folders both containing vbc.exe.

 

[Layback Bear]

In my opinion I wouldn't worry about them. I have several all the time. Windows Defender Offline indicated no problem I would believe it. vbc.exe can be a virus but not all vbc.exe are a virus.
Happy computing.

 

[Alejandro85]

All the traces you've told here indicate that it IS A VIRUS.

First off, there is a legitimate file in the system named "vbc.exe", it's the Visual Basic command line compiler, and is located under c:\windows\microsft.net\someotherfolder. That said, normally when you see exe processes spawning on it's own on strange locations, you have all reasons to doubt.

The folders are located under TEMP, a location normally reserved for temporary data files, or maybe for temporary programs that delete themselves afterwards. The folder name is also strange, probably random, which seems suspicious too. Moreover, if it's running on its own at system startup without your knowledge, and using the very same filename of a well known system executable, you have all reasons to doubt.

Look at msconfig from where it autoruns, delete those and all instances you find of the exe. And just in case, enable your firewall to block outgoing connections. This time I think MSE got it right and you're effectively infected.

 

[marsmimar]

I've asked for one of the Forum's malware experts to take a look and give an opinion. I trust her judgement completely.

 

[Maxheadroom]

any news from the malware expert marsmimar?

 

[marsmimar]

There's a few hours time difference so I'm hoping we'll hear something real soon.

 

[Maxheadroom]

ok thanks

 

[Jacee]

Max, yes you are in fected ... read about the infection here: Generic.bfr!09E9EAAFB04E | Virus Profile & Definition | McAfee Inc.

You are going to have to use a known 'clean' computer to change all your passwords. Do not use the infected one.

Now, download TFC by Old Timer TFC - Temp File Cleaner by OldTimer - Geeks to Go Forums and save it to your desktop.
Save any unsaved work. TFC will close ALL open programs including your browser!
Double-click on TFC.exe to run it. If you are using Vista/Windows 7 right-click on the file and choose Run As Administrator.
Click the Start button to begin the cleaning process and let it run uninterrupted to completion.
Important! If TFC prompts you to reboot, please do so immediately. If not prompted, manually reboot the machine anyway to ensure a complete clean.

TFC (Temp File Cleaner) will clear out all temp folders for all user accounts (temp, IE temp, java, FF, Opera, Chrome, Safari), including Administrator, All Users, LocalService, NetworkService, and any other accounts in the user folder. It also cleans out the %systemroot%\temp folder and checks for .tmp files in the %systemdrive% root folder, %systemroot%, and the system32 folder (both 32bit and 64bit on 64bit OSs). It shows the amount removed for each location found (in bytes) and the total removed (in MB). Before running, it will stop Explorer and all other running apps. When finished, if a reboot is required the user must reboot to finish clearing any in-use temp files.
TFC only cleans temp folders. TFC will not clean URL history, prefetch, or cookies. Depending on how often someone cleans their temp folders, their system hardware, and how many accounts are present, it can take anywhere from a few seconds to a minute or more. TFC will completely clear all temp files where other temp file cleaners may fail. TFC requires a reboot immediately after running. Be sure to save any unsaved work before running TFC.

After rebooting, let's flush the bad DNS cache and restore MS's Hosts file:
Copy and paste these lines in Note pad.

@Echo on
pushd\windows\system32\drivers\etc
attrib -h -s -r hosts
echo 127.0.0.1 localhost>HOSTS
attrib +r +h +s hosts
popd
ipconfig /release
ipconfig /renew
ipconfig /flushdns
netsh winsock reset all
netsh int ip reset all
shutdown -r -t 1
del %0

Save as flush.bat to your desktop.
Double click on the flush.bat file to run it.Vista and Windows 7... right click the .bat file and choose to run as Administrator. *Your computer will reboot itself*.

Now, I'd like you to scan your machine with ESET OnlineScan

1. Hold down Control and click on the following link to open ESET OnlineScan in a new window.
   ESET OnlineScan
2. Click the
   
   button.
3. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
   1. Click on
      
      to download the ESET Smart Installer. Save it to your desktop.
   2. Double click on the
      
      icon on your desktop.
4. Check
   
5. Click the
   
   button.
6. Accept any security warnings from your browser.
7. Check
   
8. Push the Start button.
9. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
10. When the scan completes, push
    
11. Push
    
    , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
12. Push the
    
    button.
13. Push
    

 

[Maxheadroom]

thank you Jacee i will do this asap, can i just ask
you mention changing my passwords does it matter if the clean computer is networked and do i need to change all my passwords as this virus may have copied them?

 

[Layback Bear]

Thank you Jacce for coming to the rescue. I will watch and learn.

 

[Jacee]

thank you Jacee i will do this asap, can i just ask
you mention changing my passwords does it matter if the clean computer is networked and do i need to change all my passwords as this virus may have copied them?

You have a 'trojan' ... it's better to change all passwords that may have been compromised, rather than be sorry later.
If the 'networked' computer is clean, then you can use it.

 

[Maxheadroom]

C:\Users\KandC\Downloads\SoftonicDownloader_for_windows-live-movie-maker.exe Win32/SoftonicDownloader.D application cleaned by deleting - quarantine

F:\FireFox\DTLite4454-0315.exe Win32/OpenCandy application cleaned by deleting - quarantined

J:\Audio\audio.rar probably a variant of Win32/TrojanProxy.Agent.IIIVZSY trojan deleted - quarantined

J:\Galaxy S2\Rom Flashing\Roms\DlevROM2_3.0_KI4.zip multiple threats deleted - quarantined

J:\Galaxy S2\Rom Flashing\Roms\DlevROM2_3.1_KI4(1).zip Android/MTracker.A application deleted - quarantined

J:\Galaxy S2\Rom Flashing\Roms\Hyperdroid_Androidmeda-XDXD9-signed.zip a variant of Android/MTracker.A application deleted - quarantined

J:\Galaxy S2\Rom Flashing\Roms\DlevROM 1.3\DlevROM2_1.3.zip Android/MTracker.A application deleted - quarantined

J:\Galaxy S2\Rom Flashing\SuperOneClickv1.9.5\Exploits\psneuter Android/Exploit.Lotoor.AK trojan cleaned by deleting - quarantined

J:\STUFF\GAZ'S\from desktop\Rom Flashing\DlevROM 1.3\DlevROM2_1.3.zip Android/MTracker.A application deleted - quarantined

J:\STUFF\GAZ'S\from desktop\Rom Flashing\SuperOneClickv1.9.5\Exploits\psneuter Android/Exploit.Lotoor.AK trojan cleaned by deleting - quarantined

 

[Maxheadroom]

after i restarted the pc theres no more MSE warnings and no dodgy looking files in the temp folder, thank you Jacee looks like its gone.

Do you class ESET/nod32 as a better virus scanner than MSE and is it possible to use both or not necessary?

 

[Jacee]

Keep MSE, but every once in a while scan with ESET online scanner!

Make a clean/fresh restore point now: Turn off System Restore, reboot, now turn on System Restore http://www.sevenforums.com/tutorials/81500-system-restore-enable-disable.html

All old restore points will be cleared out, so you don't have the chance of going back to an infected point.

 

[Maxheadroom]

thanks for the help Jacee