For Home

Virus Profile: VBS/Netlog.f

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 8/14/2000
Date Added: 8/15/2000
Origin: Unknown
Length: 1392
Type: Virus
Subtype: Internet Worm
DAT Required: 4092
Removal Instructions
   
 
 
   

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

Existence of the NETWORK.VBS files, home page changed. Note that a normal Windows system will have a file called "c:\windows\wsh\samples\network.vbs" which is innocent and not related to this worm.

Methods of Infection

Running this file will directly install to the local machine and then it will begin scanning for available shares over the Internet.

Related Viruses

VBS/Netlog.worm.a
   

Virus Characteristics

This is like VBS/Netlog.a, except that it only scans the IP range 209.214.x.x and does not keep a log of its activity. The script changes the registry key "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page" to "http://networktracker.tripod.com". This page does not contain any malicious scripts or files as of the writing of this description, but that could change in the future. The page seems to just be an attempt at tracking the number of infected machines.
   
Use specified engine and DAT files for detection and removal. Delete files found to contain this detection.

As this threat seeks open shares, turn off full share to your system. If you have to use shares, use password protection to avoid being a future target.

Additional Windows ME/XP removal considerations