C / C++ / MFC

20-Dec-03 10:45

Hi,

I got a virus on my PC. I have figured out that there is a malicious *.dll (msconfd.dll in the system dir) on my system. Problem I can't delete it because it is attached to an instance of svchost.exe. I cant delete the *.dll while attached, and I cant delete the svchost.exe because another instance of it gets spawned immediately.

Please help. Thanks for any info in advance.

Pepe

PJ Arends20-Dec-03 12:23

PJ Arends

20-Dec-03 12:23

Maybe this link can help?

http://www.trendmicro.com/en/security/general/infected/overview.htm[^]

Sonork 100.11743 Chicken Little

"You're obviously a superstar." - Christian Graus about me - 12 Feb '03

Within you lies the power for good - Use it!

Anonymous20-Dec-03 13:37

20-Dec-03 13:37

thanks for your reply.
I did a scan with this tool, it makes a spectacular search through the file system, and found some html files in the temp internet files folder with some harmless javascript code in it which it called viruses but it didnt reveal anything about the above issue.

Just some more info about the beast:
It wrote itself to this registry key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_Dlls

and as such attaches the all apps which link to the user32.dll. I could remove this entry manually but when the the dll detaches it writes itself back. This of course also happens on Windows exit, when the last UI app closes e.g. Regedit. It is also attached to svchost.exe as a result of which I am not able to delete the key "late enough".

I am stuck.

Pepe

Anonymous20-Dec-03 13:52

20-Dec-03 13:52

It furthermore attaches to explorer.exe, cmd.exe, and all services too.
Seems to be the perfect virus.

Roger Wright20-Dec-03 14:04

Roger Wright

20-Dec-03 14:04

First, go to www.sarc.com[^]. Under the heading "Virus Definitions" look for a link to "Free Online Virus and Security Check." Click on it, wait for the popup, then select the free virus scan. Once the scan is complete, it will identify the specific viruses it found by name. Write them down, along with all the path information about where they're located.

Return to the home page and search for the virus(es) by name. Once found, you should be directed to either a removal tool available for download, or instructions for manual removal. If it's a "popular" virus the removal tool will be listed on the main page. Follow the excellent step-by-step instructions they usually provide to clean your machine. If this solves the problem, say a thankful prayer (if you're so inclined) for Symantec for providing this extraordinarily useful website. And to really be properly thankful, buy yourself a copy of their antivirus product for Christmas and keep it up to date. Big Grin | :-D

This site has saved many a customer's PC from the dreaded FDISK fate!

"Another day done - All targets met; all systems fully operational; all customers satisfied; all staff keen and well motivated; all pigs fed and ready to fly" - Jennie A.

Newbie Question: C vs C++

David Crow22-Dec-03 3:56

David Crow

22-Dec-03 3:56

See if you can boot up in safe mode, then delete the DLL file.

Five birds are sitting on a fence.
Three of them decide to fly off.
How many are left?

tguzella20-Dec-03 9:42

tguzella

20-Dec-03 9:42

Hi there

I have a question: how does a c++ compiler generate code?? does it convert the c++ code to c and then to assembly?? I am asking that because i need to write a number crunching program (it needs to be as fastest as possible), and i am thinking of initially writing it in C++ (i love C++'s OOP), then going to assembly. I am willing to sacrifice ease of programming in favor of speed, so should i write it in C or stay with C++??

Thanks
Thiago Guzella

Tim Smith20-Dec-03 9:53

Tim Smith

20-Dec-03 9:53

Most compilers go from the language to a generic pcode format. Then the linker takes the pcode and generates machine code while doing some high level optimizations.

In general, C++ is just as fast as C but it can be easy to do silly stuff that slows C++ down. Also, with the current crop of optimizers, converting the C++/C code to asm usually is more of a waste than a benefit.

Tim Smith

I'm going to patent thought. I have yet to see any prior art.

markkuk20-Dec-03 12:08

markkuk

20-Dec-03 12:08

The first C++ compiler (AT&T Cfront) used C as an intermediate step, but nearly all current C++ compilers create machine code directly. The only exception I know is Comeau C++

John R. Shaw20-Dec-03 16:19

John R. Shaw

20-Dec-03 16:19

I see the code generation question have been aswered. Now for speed.

C is closer to asm than C++ and is therefore the best place to start if you think you may want to convert the code to asm. The conversion is not normaly needed as modern compilers are very good at optimizing. There is the possiblity that you could improve on the asm code produced by the compiler, but fist let it generate the code for you to examine what it has done. Also, make sure that it is being compiled as C code (not C++) or it might contain unneeded overhead.

Good luck!

INTP

Anonymous20-Dec-03 18:25

20-Dec-03 18:25

Just wirte your assembly code as inline and make the function declaration as naked this will remove all c++ prolog and epilog to a function (like stack checking, parameter checking etc etc). if you do this then you dont have to worry what compier does.

ZoogieZork20-Dec-03 19:50

ZoogieZork

20-Dec-03 19:50

If there's one thing I learned when I started diving into building my own compiler, it's that modern C and C++ compilers are smart. Very smart.

That said, they aren't perfect, and sometimes they'll focus optimizations on parts of your code that aren't as critical, or they'll refuse to do certain optimizations because it cannot be proven from the language definition that the optimization is safe. And, of course, they can't magically pick a better algorithm for you.

What this means in practical terms is that you shouldn't try to do premature optimizations. Write it in the language of your choice. Benchmark it. Profile it. You might just find that it's fast enough already. If not, you can find the bottlenecks and then break out the assembly.

- Mike, who has wasted entire too much time optimizing for code which wasn't a problem.

John M. Drescher21-Dec-03 7:32

John M. Drescher

21-Dec-03 7:32

First off do not use .NET managed C++. I would program it in C++ and add assembly where needed. One case in point is if you have to do any float to int calculations do not let the compiler do that. The cpu does rounding by default and the standard states it should be truncated. So the compiler inserts over 100 asm instructions to reverse the rounding process. In a bilinear interpolation algorithm I got a factor of 10 speed up by using asm to do the conversion. Also where possible I would use MMX, and SIMD.

John

tguzella22-Dec-03 5:00

tguzella

22-Dec-03 5:00

thanks...
that's what i am kinda thinking about: writing the program in C++ under visual c++ 6, and using inline assembly to optimize where necessary for mmx/3dnow/sse. i could do that under .net using intrinsics, but i don't feel much confortable with that...