Printable View
If you got it off of Mirc, it sounds to me like an script that adds features like port scans, cloning, dos attacks, etc. That is why McAfee is picking it up as a malicious script. It may not be harmful to your box, but the things that it does throws up a red flag. I have seen this alot with custom scripts....try to unload it from Mirc...Good luck....
like my good man bballad said :D
i don't have any .vbs files on my winbox(work)...
i don't run windows at home, and am not too familiar with newer (NT) window's versions...
i take back my statement about deleting the .vbs files (although would work for me) and apologize if any-one followed my advise and deleted something important...
you didn't have to be so mean about it :(
Quote:
Originally posted here by bballad
Two points on this.
Your advice would not work for a 9x box
I have used vbscript to automate some administrative tasks..besides the scripts I have writen and some siteserver stuff I have never seen a .vbs file that I couldn't get rid of.
All you have to do for 9x is remove the *.vbs file association from the WSH executable. Problem solved, and that can be done on any winhoes box.
And you're a fool if you think it's ok just to haphazardly delete script files.
o.k. I know a few of you simpletons negged me for my post, with whiney bitch like excuses such as: "im a newbie, give me a break" well thats all fine and good, but what you don't understand is when you talk out of your ass, and spread WRONG information, you do more harm than good. Now kindly go die.
quad=neg, again quad=neg you got it yet?? Plus "now kindly go die" thats not very helpful, you should have specified this post as hidden.
AHAHAHAHAHHAHAAHHA!!!!
you=blow me, again you=stupid ignorant ******* you got it yet?? Plus "You can swallow while you're at it" Is that more helpful, should I have specified this as hidden?
I'll try looking around in the regesitry and see if anything looks funny there, and post it. One thing about this that puzzles me is that I can connect to my DSL when the first little box pops up but after I press ok I am not able to connect anymore.
I tried searching around a little bit for the source of the script but couldn't find it. I'll try to post what I find again tomorrow, but its farming season over here and I've been working 12 hour days. Thanks for all the help
I did what I should of done in the first place. I went to the command prompt and type in dir *.vbs and it found the script file. It was named NAKTT89.VBS. I tried to open it to look at the source, and when I did that Mcaffe then found it and asked me if I wanted to delete, clean etc. So I deleted it. Finally its over. Thanks for the help.
BTW the website I posted I put a instead of cacing-crew-du.ru. its www.cacing-crew.da.ru.
You know what might help you as well, is using software to deter future VB script attacks as well. I currently have TCMonitor(monitors registry for any changes), TCActive!(All Active processess running on your computer) and ScriptSentry(runs with associated files to check for malicous VB script).
ScriptSentry download here
(under Security Tools)
-and-
The Cleaner, TCActive and TCMonitor download here
Task List Website
this website accompanies TCActive! very well, it lists many running tasks on your computer and what they do and/or if they are essential or not.
I use this programme to prevent unwanted vbs scripts
http://home.earthlink.net/~doniteli/index46.htm
Try Spybot. It picks up things Mcafee misses.
www.security.krolla.de.
humm considering that microsoft recomends turning off scripting unless you are activly hum considering that Microsoft recommends turning off scripting unless you are actively writing your own scripts I doubt there are any scripts on a home system that you can't delete. Note that the only program I have seen that needs some scripts is site server and that is to format log output. Remember a .vbs file is basically a beefed up .bat file, they are not real programs, and basically not needed at all. So yes go delete them unless you are actively using them.Quote:
Originally posted here by Quad
All you have to do for 9x is remove the *.vbs file association from the WSH executable. Problem solved, and that can be done on any winhoes box.
And you're a fool if you think it's ok just to haphazardly delete script files.
?
By turning off the script accosiation form the script engin you have basicly deleted them as they are worthless without the scripting engin.
thanks for explaining... bballad :)Quote:
... If you are not on a big network, and no one else is using you machine- then it's a safe bet you don't need any VisualBasic scripts...
Thanks