xmmcc exe keylogger virus cleanup

When I connected a pen drive to my PC, I found that the pendrive's root directory had two files, although I had never copied them 

1. xmmcc.exe 

2. Autorun.inf

I tried deleting them, but as soon as they were deleted, they came back within a second automatically. After some googling, I found that it was a keystroke logger virus.I could not find proper steps in a single place (must be bad googling), so here I am consolidating all steps I followed to clean the virus.

Step 1:

Using Process Explorer, I found that there were two "services.exe" running. One had the company name as "Microsoft Corporation", but the other file did not have any detail displayed under the "Description" column. Also, it had the same icon I saw in the pendrive (of two fingers pressing the keyboard). I first killed the process.

Step 2:

In the following folder, there were 3 files.

C:\Windows

1. xmmcc.exe

2. services.exe (with the same finger icon).

3. hardshad.log

One more verification point for the exe file is that the properties of the EXE file shows the original name as "hardshad.exe".

The file "hardshad.log" contains all the keystroke made by the  user since the time the virus got installed.

I deleted all 3 files.

Step 3:

Opened registry (regedit.exe).

Selected the root node. Then, searched for "xmmcc"..

It showed many entries, most of them pointing to drives allocated to pendrives. I deleted them all, except one. which showed

"explorer.exe xmmcc.exe"

Here, I opened the value entry, and removed only the "xmmc.exe" and left the "explorer.exe" as it is.

After I rebooted the system, the virus was no longer present.

Microsoft Picture Fax Viewer problem

With picasa and a host of other picture viewing programs, the default image viewer Microsoft's Picture and Fax Viewer kind of went into oblivion for me. One fine day, I wanted to use it for viewing images (out of pure nostalgia) and found out that it was not getting listed at all in my "Open with" menu. I also was not able to find it through any program. After googling, I found out that it is actually a DLL, shimgvw.dll and needs to be launched with rundll32.exe. So, I tried that. I typed

rundll32 shimgvw.dll,ImageView_Fullscreen

both in "Run" prompt as well as from the command line. Both gave me an error. "Missing entry ImageView_Fullscreen". None of the forums seem to have given a solution to fix this issue. After some more unlucky searches, I ended up with this command to be run. In the command line, run "regsvr32 /i shimgvw.dll" (without the quotes). It should say "registered successfully". Voila, my problem was solved. The viewer started appearing in my right click menu. I still do not know how it vanished in the first place. But, atleast I know how to bring it back.

No Help inside VC IDE

I recently implemented the Help feature for an application. But, pressing F1 key or clicking on the corresponding button did not work out at all. No help window popped up. After much googling, I fell on this. This does not work when the application is run from inside the VC IDE. So, I went to the Debug directory and launched the application from there. Voila, help worked. But, still when pressing F1 key, I was getting an error message stating the the HLP file was missing. So, in order to disable that, the ON_WM_HELPINFO needed to be handled. Once that is done, the unwanted error message stops showing its ugly face.

Adding accelerator keys in VC

A microsoft support link shows in a pretty straightforward way how to implement an accelrator key. Have a go

Getting the hyper link to work in CRichEditCtrl

Trying to get a mouse click to work in RichEdit and not succeeding? I faced a similar issue and ended up with this flow

Set the SetEventMask for your m_MyRichEdit (this is my control variable for the CRichEditCtrl class) to understand links

m_MyRichEdit.SetEventMask( \
m_MyRichEdit.GetEventMask() | ENM_MOUSEEVENTS)

Now, add a override function for OnNotify in your class. In the .h file, add

afx_msg BOOL OnNotify (WPARAM wParam, \
LPARAM lParam, LRESULT *pResult);

Add the corresponding function similar to the one below

BOOL CParentDlg:: OnNotify (WPARAM wParam, LPARAM lParam, LRESULT * pResult) 
{

if (LOWORD (wParam) == IDC_RICHEDIT) 
{ 
  MSGFILTER * mf = (MSGFILTER *) lParam; 
  switch (mf-> msg) 
  { 
    case WM_LBUTTONUP: 
        ENLINK *p_EnLink;
        p_EnLink = (ENLINK *)lParam;
        m_MyRichEdit.SetSel (p_EnLink->chrg);
 CString szLinkString = m_RichEdit.GetSelText ();
        break; 
  ) 
) 

return CDialog:: OnNotify (wParam, lParam, pResult); 
)

Now, your szLinkString will have the data you need to manipulate. You can use this with the ShellExecute function to popup whatever you want.

On, by the way, you need to add RTF content if you intend to make that identifiable. It goes something like

CString szT = "{\\rtf1 \\par http " + szAppendString + " \\par}";

My above code will popup a http link using which I Open it in ShellExecute

Auto Complete in VC++ 6

When the "Auto Complete" (Complete Word) feature of VC (6 in my case) stops working, all you need to do is
1. close the project
2. Go to the project directory
3. Remove the .ncb file in the directory
4. Re-open the project

Voila, its working !!!
(atleast it started working for me).

Ensoy

CTreeCtrl and Checkboxes

While working with CTreeCtrl with checkboxes, I came across these 2 issues

1. You would have set TVS_CHECKBOXES in the .rc file. Then during InitDialog, if

m_myTreeVar.SetCheck( hTreeWnd, TRUE)

is called, it will not work as expected. But, when the same line is called anywhere else later, it will work. To workaround this issue, the following two lines need to be added to simulate a removal/addition of the checkboxes flag at the beginning of InitDialog

m_myTree.ModifyStyle( TVS_CHECKBOXES, 0 );
m_myTree.ModifyStyle( 0, TVS_CHECKBOXES );

2. With the CTreeCtrl, when trying to get the handle of a "clicked" item using hittest, I fell on an issue that it was returning the handle of the NEXT item on the list and not the one which i clicked. The code is as below

 DWORD pos = GetMessagePos();
 CPoint pt(LOWORD(pos), HIWORD(pos));
 ScreenToClient(&pt); 
 UINT uFlags = 0; 
 HTREEITEM hItem = m_MainTree.HitTest(pt, &uFlags);

The above code returned the handle of the next list item from the one clicked. To fix the same, I just modified the "ScreenToClient" as below

m_myTree.ScreenToClient(&pt); 

and Voila!!! it worked!