Virus Profile: VBS/Ardin

Threat Search
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 4/7/2004
Date Added: 4/20/2004
Origin: Unknown
Length: 1,561 bytes
Type: Virus
Subtype: Script
DAT Required: N/A
Removal Instructions


This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

Email messages in your Microsoft Outlook Sent Items folder which you did not send.

Methods of Infection

Executing the VBScript file. 

Virus Family Statistics (over the past 30 days)

Family Statistics information
Virus Name Infected Files Scanned Files % Infected Computers
VBS/Ardin 0 0 0.00

Virus Characteristics

This VBS/Ardin affects users who have the Windows Scripting Host (part of Internet Explorer 5), and Microsoft Outlook installed.

VBS/Ardin arrives in an email with the following characteristics:

Subject : hey
Body : who are u
Attachment : Lugburz.VBS

If this virus find files of type ".VBS", it will overwrite and replace them with its own code.

On the January 1st a message is displayed:


All Users:
Use current engine and DAT files for detection and removal.

Modifications made to the system Registry and/or INI files for the purposes of hooking system startup, will be successfully removed if cleaning with the recommended engine and DAT combination (or higher).

But in some particular cases, the following steps need to be taken.

Please go to the Microsoft Recovery Console and restore a clean MBR.

On Windows XP:

  • Insert the Windows XP CD into the CD-ROM drive and restart the computer.
  • When the "Welcome to Setup" screen appears, press R to start the Recovery Console.
  • Select the Windows installation that is compromised and provide the administrator password.
  • Issue 'fixmbr' command to restore the Master Boot Record
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.

On Windows Vista and 7:

  • Insert the Windows CD into the CD-ROM drive and restart the computer.
  • Click on "Repair Your Computer".
  • When the System Recovery Options dialog comes up, choose the Command Prompt.
  • Issue 'bootrec /fixmbr' command to restore the Master Boot Record.
  • Follow onscreen instructions.
  • Reset and remove the CD from CD-ROM drive.

PC Infected? Get Expert Help

Virus Removal Service

Connect to one of our Security Experts by phone. Have your PC fixed remotely - while you watch!