VB Script.

I recentyl ran into a problem on my computer. Everytime I start up my Win98 box I get a window that says VB script. the message that comes with it is in foreign language so I have no idea what it says.

The first option is to press ok, then the next option is yes or no, then if you press no your compuer shuts down, if you press yes it does nothing. I put Mcaffe on there and now when I press no Mcaffe gives me a warning about Malicious script and allows me to stop it from shutting down my computer.

I'm not at the computer right now that has this problem, but if I press details on Mcaffe it says something about it being a shell.

Any help would be appreciated.

If you could post the message perhaps we could translate it?

Check win.ini and your start folder for any odd looking programs that run at startup.

hey, looks like you just might be infected with some sort of script virii...
simple solution is to look for all VB scripts and remove/delete them - that is of course if you don't need them... If you are not on a big network, and no one else is using you machine- then it's a safe bet you don't need any VisualBasic scripts...

I'd suggest deleting the .vbs

.vbs ? is that right-?

I was looking through win.ini startup folder and under a folder called Postscript I see names like Times new Roman, etc which is just some font tpes. However the farther I scroll down I see names like @///]]\\345838dkdka. theres a bout another 12 of those in the win.ini folder. I tried unchecking them but he vbscript still popped up.

When I get to that computer later today I'll post the details that Mcaffe brought up.

Have you goten any mail and visited a URL in the e-mail or downloaded any attachments there? If so then that sounds like the classic macro worm. Though your AV is preventing the script from running... that won't totaly get rid of the problem intil you completly removed it and fixed any problems it may have unleashed.

I remember hearing here that on a XP box the desktop.ini can be used to shutdown a comp as soon as you login. There are also many other ways to shuting down a windows comp.

I think I got this off of Mirc. I was trying to learn Mirc and somehow I got this little script.

Hers the detail that Mcaffe gave me though

This script is attempting to call the run method which runs an application

Interface name: IWshShell
Interface documentation: Sehll Object Interface
Method Name: Run
Method Documentation: (nothing on this line)

Thats what Mcaffe says about it. Its the newest version of Mcaffe and I did a full system scan but it didn't pick up anything.

It also gives me a website www.cacing-crew.du.ru. Got there at your own risk.

The page is down for whatever that is worth. Defiantly a Trojan of some sort I am thinking..it was probably trying to collect data and send it to someone with an address at this site.

Da.ru is some type of dynamic domain name hosting service from what I can tell. Used for address masking (ie no whois info).

Cacing crew web site is mostly in Russian I’m no help there (any one know a russian?) but all of their pages are down…its some sort of hacking group I’d guess, they seem to be political, anti-war and anti Americana from the posts I have seen by them…a lot ofit is in Russian so I am not 100% sure on that .


So this is some sort of script virus or what not..perhaps even something like a BO trumpet..these guys seem to be into IRC.

First off to the moron who posted "find and delete all VBScript" you need to go shoot yourself in the face. Windows has tons of VBscripts that are supposed to be there and if you delete them, **** will not work. If you really want to stop the virus threat do this:

c:\winnt\system32\wscript.exe change the permissions to "special access read only"
c:\winnt\system32\cscript.exe change the permissions to "special access read only"

or c:\windows\system32 for windows 9x users.

What this does is dissable the windows scripting engine from being run by scripts. Then if you run into an application that NEEDS access to it, you can modify the permissions accordingly.

I recomend that you found the file. Look at regedit into the local_machine folder, then software, then Microsoft, then windows, current vercion, run. and check the keys in there.
Post here any suspicius key for more help


xDrack

Quote:

---

Originally posted here by Quad
First off to the moron who posted "find and delete all VBScript" you need to go shoot yourself in the face. Windows has tons of VBscripts that are supposed to be there and if you delete them, **** will not work. If you really want to stop the virus threat do this:

c:\winnt\system32\wscript.exe change the permissions to "special access read only"
c:\winnt\system32\cscript.exe change the permissions to "special access read only"

or c:\windows\system32 for windows 9x users.

What this does is dissable the windows scripting engine from being run by scripts. Then if you run into an application that NEEDS access to it, you can modify the permissions accordingly.

---

Two points on this.
Your advice would not work for a 9x box
I have used vbscript to automate some administrative tasks..besides the scripts I have writen and some siteserver stuff I have never seen a .vbs file that I couldn't get rid of.

If you got it off of Mirc, it sounds to me like an script that adds features like port scans, cloning, dos attacks, etc. That is why McAfee is picking it up as a malicious script. It may not be harmful to your box, but the things that it does throws up a red flag. I have seen this alot with custom scripts....try to unload it from Mirc...Good luck....

like my good man bballad said :D
i don't have any .vbs files on my winbox(work)...
i don't run windows at home, and am not too familiar with newer (NT) window's versions...

i take back my statement about deleting the .vbs files (although would work for me) and apologize if any-one followed my advise and deleted something important...

you didn't have to be so mean about it :(

Quote:

---

Originally posted here by bballad

Two points on this.
Your advice would not work for a 9x box
I have used vbscript to automate some administrative tasks..besides the scripts I have writen and some siteserver stuff I have never seen a .vbs file that I couldn't get rid of.

---

All you have to do for 9x is remove the *.vbs file association from the WSH executable. Problem solved, and that can be done on any winhoes box.

And you're a fool if you think it's ok just to haphazardly delete script files.

o.k. I know a few of you simpletons negged me for my post, with whiney bitch like excuses such as: "im a newbie, give me a break" well thats all fine and good, but what you don't understand is when you talk out of your ass, and spread WRONG information, you do more harm than good. Now kindly go die.

quad=neg, again quad=neg you got it yet?? Plus "now kindly go die" thats not very helpful, you should have specified this post as hidden.


AHAHAHAHAHHAHAAHHA!!!!

you=blow me, again you=stupid ignorant ******* you got it yet?? Plus "You can swallow while you're at it" Is that more helpful, should I have specified this as hidden?

I'll try looking around in the regesitry and see if anything looks funny there, and post it. One thing about this that puzzles me is that I can connect to my DSL when the first little box pops up but after I press ok I am not able to connect anymore.

I tried searching around a little bit for the source of the script but couldn't find it. I'll try to post what I find again tomorrow, but its farming season over here and I've been working 12 hour days. Thanks for all the help

I did what I should of done in the first place. I went to the command prompt and type in dir *.vbs and it found the script file. It was named NAKTT89.VBS. I tried to open it to look at the source, and when I did that Mcaffe then found it and asked me if I wanted to delete, clean etc. So I deleted it. Finally its over. Thanks for the help.

BTW the website I posted I put a instead of cacing-crew-du.ru. its www.cacing-crew.da.ru.

You know what might help you as well, is using software to deter future VB script attacks as well. I currently have TCMonitor(monitors registry for any changes), TCActive!(All Active processess running on your computer) and ScriptSentry(runs with associated files to check for malicous VB script).

ScriptSentry download here
(under Security Tools)
-and-
The Cleaner, TCActive and TCMonitor download here

Task List Website
this website accompanies TCActive! very well, it lists many running tasks on your computer and what they do and/or if they are essential or not.

I use this programme to prevent unwanted vbs scripts
http://home.earthlink.net/~doniteli/index46.htm
Try Spybot. It picks up things Mcafee misses.
www.security.krolla.de.

Quote:

---

Originally posted here by Quad



All you have to do for 9x is remove the *.vbs file association from the WSH executable. Problem solved, and that can be done on any winhoes box.

And you're a fool if you think it's ok just to haphazardly delete script files.

?

---

humm considering that microsoft recomends turning off scripting unless you are activly hum considering that Microsoft recommends turning off scripting unless you are actively writing your own scripts I doubt there are any scripts on a home system that you can't delete. Note that the only program I have seen that needs some scripts is site server and that is to format log output. Remember a .vbs file is basically a beefed up .bat file, they are not real programs, and basically not needed at all. So yes go delete them unless you are actively using them.

By turning off the script accosiation form the script engin you have basicly deleted them as they are worthless without the scripting engin.

Quote:

---

... If you are not on a big network, and no one else is using you machine- then it's a safe bet you don't need any VisualBasic scripts...

---

thanks for explaining... bballad :)

Thanks