VBS file

This seemed like the best place to post about this. Ive come across a file on my domain network. in just about all of the shares on the servers i find a W610QT.VBS file. i googled it but i didnt find anything about it. i dont want to attach the file in case its malicous or something but here is the code thats in it...




Thanks for any help on this,
KJ

 

It's some kind of malware. Currently I translate the script to somewhat human readable. I will PM you.

I suggest you to ask an admin to remove the source code from your post. Otherwise we leave a draft for scripters in this forum ...

Regards
GermanOne

 

OK that's what it tries to do:
- copying itself as C:\Windows\System32\W610QT.VBS
- autorun via registry
- selfcopy to each found network drive
- write an email to each found address in MS Outlook with the script attached

Regards
GermanOne

 

Ill make sure all the servers are scanning asap... tomorrow morning lol. probably lucky we arent using outlook but its still annoying to find in your drives.

Thanks for the help!!

 

You're welcome.

It's probably not enough to remove it from the server shares. If any client already run the script it will be executed automatically each time the computer starts up (in case the client had rights to write to HKEY_LOCAL_MACHINE of course).

Regards
GermanOne

 

Appreciate the help, GermanOne.

IrOnMaN, please be careful with posting that stuff here. We don't want others to get infected.

 

sure next time ill just pm it to someone that offers to look at it.

 

Don't worry, you were simply not aware it was malicious code.
Of course you can always PM me whenever you found an obscure script

 

i scanned the servers today and it did find it and remove it. i didnt see it in the registry on my computer or the server i found it on but ill try to check when im on computers at the sites. The scanner picked it up as VBS:SelfMailer-D[WRM]

 

Yeah perhaps you're lucky and the clients don't have rights to write in C:\Windows\System32 or even HKEY_LOCAL_MACHINE. In that case it was only copied to the net drives.