W2000M/CHACK.BH MACRO VIRUS (Please Help!)

[Phixtit]

Somehow I've got a Macro Virus. I noticed it when I sent my workbook to my other computer & my other Antivirus stopped it.
I had Enable all Macros selected, as well as Trust All VBA. As I was only using my own workbook.
I think I opened a sample excel program off the web and somehow I think it worked it's way into my Workbook.
If I press ALT-F11 and Delete all Forms & Modules and send to my other computer and it's good. Then on my other computer I add my Forms & Modules from an older clean workbook and as soon as I try to save it says I got a Macro Virus. I've searched the web with no answers.
I think I'm the only one with this Macro Virus called: W2000M/CHACK.BH
I'm completely lost...
I'm running AVG Anti-Virus SBS Edition & it doesn't even pick it up.
My other computer is running Avira and finds the Macro Virus but doesn't clean it.
I've tried Norton & Avast and they don't pick it up either.
I could sure use a point in the right direction, or better yet a hand at removing this as I have hundereds of hours into my workbook...

 

[VoG]

You could try a scan with a-squared free http://www.emsisoft.com/en/software/free/

 

[ZVI]

Sometimes it happens without any viruses in a workbook.
It is because the part of XLS file matches the signature of virus in database of antivirus software. It happens seldom, but I faced with it several times.

To solve wrong alert of antivirus:

1. Find VBA module which causes antivirus alert
1.1. Comment all VBA-code
1.2. Step by step uncomment each VBA modules and try to save workbook.
1.3. Remember the module causes wrong antivirus alert

2. Find the line of VBA module which cases to wrong alert of antivirus
2.1. Comment all code lines in the module
2.2. Step by step uncomment each code line in module and try to save workbook.
2.3. Remember the line causes wrong antivirus alert

3. Try reformat code of the found line
3.1. Use two lined by segmentation of the line and using of " _" at the end of the part.
For example if you have such line:
Range("A1:A2”) .Value = Range("B1:B2”) .Value
Then the modified would be like this:
Range("A1:A2”) .Value = _
Range("B1:B2”) .Value
3.2 Use additional spaces or remove spaces at the left side of the line.
3.3 Replace some VBA code to the same, but with another syntax, for example Range("A1:C2”) .Value to [A1:C2].Value or Range("A1:C” & 2) .Value etc

Vladimir

 

[Phixtit]

Sometimes it happens without any viruses in a workbook.
It is because the part of XLS file matches the signature of virus in database of antivirus software. It happens seldom, but I faced with it several times.

To solve wrong alert of antivirus:

1. Find VBA module which causes antivirus alert
1.1. Comment all VBA-code
1.2. Step by step uncomment each VBA modules and try to save workbook.
1.3. Remember the module causes wrong antivirus alert

2. Find the line of VBA module which cases to wrong alert of antivirus
2.1. Comment all code lines in the module
2.2. Step by step uncomment each code line in module and try to save workbook.
2.3. Remember the line causes wrong antivirus alert

3. Try reformat code of the found line
3.1. Use two lined by segmentation of the line and using of " _" at the end of the part.
For example if you have such line:
Range("A1:A2”) .Value = Range("B1:B2”) .Value
Then the modified would be like this:
Range("A1:A2”) .Value = _
Range("B1:B2”) .Value
3.2 Use additional spaces or remove spaces at the left side of the line.
3.3 Replace some VBA code to the same, but with another syntax, for example Range("A1:C2”) .Value to [A1:C2].Value or Range("A1:C” & 2) .Value etc

Vladimir

I have installed Avira Server Antivirus as it is the only AV program that I have had luck with finding Viruses.

I have tried your suggestions & have found out where the problem is.
In my Form called Menu if I add the link from an active button to IntTally(sheet306) Avira reports the Macro Virus W2000M/CHACK.BH immediately.
So I have deleted IntTally(sheet306) and create a fresh IntTally(sheet306) and as soon as I add the link on the form Menu BOOM I get the Macro Virus again.

I don't understand because I have 3 identical sheets with the excact same code except for the prefix: (Surf, Int, & Prod)
Example:
SurfTally(sheet302)
IntTally(sheet306)
ProdTally(sheet310)

IntTally(sheet306) somehow gets infected as soon as I link to the Form Called Menu.

Any ideas as to why this is happening & better yet get rid of it?

 

[ZVI]

Seems it is not a virus but the case I have described.
Note that VBA-code is stored in a file in encripted format. Only commented VBA-lines are not encripted in a file.
The same part of code but stored in another lines has the different file code then saving.

So, try something like this or similar:

Previous:
IntTally(sheet306)

Changed:
IntTally( _
sheet306 _
)

Also try to add/delete some empty lines in VBA code nearby the found problematic line of code

What is the code for linking to the Form Called Menu? How you link it?

 

[ZVI]

Phixtit have sent me problematic workbook and the information at which line of code virus alarm has happened.

No virus has been found by my DRWeb antivirus software.
Thus I've downloaded and installed free Avira antivirus software for testing the issue.

The following code at saving of workbook cause the Avira alarm:

Private Sub IntTallyDrillerButton_Click()
    Sheet306.Select
    Unload Me
End Sub

Some modification of the syntax with the same functionality solves the problem on my PC.
Hope that on Phixtit’s PC all is ok too.

Variant 1 of solving:

Private Sub IntTallyDrillerButton_Click()
  With Sheet306
    .Select
  End With
  Unload Me
End Sub

Variant 2 of solving:

Private Sub IntTallyDrillerButton_Click()
  Dim n As String
  n = Sheet306.Name
  Worksheets(n).Select
  Unload Me
End Sub

As we can see the antivirus software sometimes behaves paranoid.
This is quite allowable for it but can raise certain problems for VBA- programmers.

Hope that it helped,
Vladimir

 

[Phixtit]

W2000m/chack.bh macro virus (solved!)

Phixtit have sent me problematic workbook and the information at which line of code virus alarm has happened.

No virus has been found by my DRWeb antivirus software.
Thus I've downloaded and installed free Avira antivirus software for testing the issue.

The following code at saving of workbook cause the Avira alarm:

Private Sub IntTallyDrillerButton_Click()
    Sheet306.Select
    Unload Me
End Sub

Some modification of the syntax with the same functionality solves the problem on my PC.
Hope that on Phixtit’s PC all is ok too.

Variant 1 of solving:

Private Sub IntTallyDrillerButton_Click()
  With Sheet306
    .Select
  End With
  Unload Me
End Sub

Variant 2 of solving:

Private Sub IntTallyDrillerButton_Click()
  Dim n As String
  n = Sheet306.Name
  Worksheets(n).Select
  Unload Me
End Sub

As we can see the antivirus software sometimes behaves paranoid.
This is quite allowable for it but can raise certain problems for VBA- programmers.

Hope that it helped,
Vladimir

I changed all instances of the following:

Private Sub IntTallyDrillerButton_Click()
    Sheet306.Select
    Unload Me
End Sub

To this:

Private Sub IntTallyDrillerButton_Click()
  With Sheet306
    .Select
  End With
  Unload Me
End Sub

I changed all links to the code you have provided & everything is working great!
So I never had a Virus I take it?
So why does it only show up as a virus only with Sheet306.Select and not any of the other sheet links?

Either way, Problem SOLVED! and thank you So much ZVI for all your help!!! Greatly appreciated...

 

[SydneyGeek]

Re: W2000m/chack.bh macro virus (solved!)

No, you never had a virus.
When the code compiles, very occasionally it will look like part of a virus signature and your file will be quarantined. It happened to me once during an all-nighter, and a syntax change fixed it then as well.

ZVI's method for tracking it down is a good one.

Denis

 

[ZVI]

...
I changed all links to the code you have provided & everything is working great!
So I never had a Virus I take it?
So why does it only show up as a virus only with Sheet306.Select and not any of the other sheet links?
...

> I changed all links to the code you have provided & everything is working great!

Why all? The only changing line of code in userform MenuFrm is required.

> So I never had a Virus I take it?

Yes, you never had a virus in your workbook.
It was the problem with virus signature in Avira software.
Other antivirus software that you’ve mentioned and DRweb on my PC have the stronger signature of this type of virus and not raise alarm.

> So why does it only show up as a virus only with Sheet306.Select and not any of the other sheet links?

It is the matter of case
As I’ve highlighted early the same chain of code has different binary bytes then workbook is saved because of Excel file encryption algorithm and unique set of controls / code in usefrorm or module.

In changed code the chain Sheet306.Select has been divided on two parts Sheet306 and .Select with vbCrLf and some space chars between these parts. This means that the binary code of that chain at saving differs from previous one.

Cheers!
Vladimir

 

[Phixtit]

Solved!

> I changed all links to the code you have provided & everything is working great!

Why all? The only changing line of code in userform MenuFrm is required.

I changed all my other links just in case I guess. LOL.
Preventative measures. hehe

Thanks again for all your help and assistance!