Re: Has anyone else seen/encountered the "VBS.Network" virus? I just did.

[qui3tri0t () NETZERO NET (qui3tri0t)]

Well, what I'm assuming this VBS Network virus is, is something I've
encountered while on IRC.
Really its nothing more than a VBScript worm. The worm copies itself to a
few different directories
on your computer. If its a smart worm, it will find the different IRC
Clients you use, then add some
lines to your remote section ( I know thats what it is called in mIRC ) with
the line
on 1:JOIN:#: { .dcc send $nick <location of the worm> }
It will also add itself to windows registry, with a few backups of the worm,
so if you delete one
from your computer, there is still the chance you'll have the others.
So when your computer restarts, the whole process starts over again. As for
the file "C:\Windows\TEMP\tmpB214.TMP" I myself have never seen that, but
then again, there are many
people making these "worms" and they have different ways of coding the worm.
I've included a few of these VBS Worms that I've collected so you can see
what I'm talking about.
----- Original Message -----
From: Olaf Black <olaf_black () HOTMAIL COM>
To: <INCIDENTS () SECURITYFOCUS COM>
Sent: Monday, February 28, 2000 1:22 AM
Subject: Has anyone else seen/encountered the "VBS.Network" virus? I just
did.

Hello all:

Norton Antivirus just popped up an alert indicating that it had found a
file:

C:\Windows\TEMP\tmpB214.TMP

That had been infected with the "VBS.Network" virus.

Norton first asked me if I wanted to repair the file.  Since this was the
"recommended" procedure from Norton, I went ahead and let NAV attempt to
repair the file.

NAV then came back and told me that the file could not be repaired, and that
the next "recommended" course of action would be to "quarantine" the file so
I went ahead and NAV came back and said that it successfully quarantined the
file.

With that, I have some questions.

What is the "VBS.Network" virus?  What does it do exactly?  What does
"quarantining" an infected file do?  Does it mean a file is moved off into a
"safe" directory and modified in some way?

Thanks,

Olaf

<HR NOSHADE>
<UL>
<LI>application/octet-stream attachment: Script.vbs
</UL>

<HR NOSHADE>
<UL>
<LI>application/octet-stream attachment: tune.vbs
</UL>

<HR NOSHADE>
<UL>
<LI>application/octet-stream attachment: MyPicture.bmp.vbs
</UL>

__________________________________________
NetZero - Defenders of the Free World
Get your FREE Internet Access and Email at
http://www.netzero.net/download/index.html