1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

VBS/TheThing virus keeps coming back!!

Discussion in 'Virus & Other Malware Removal' started by astroboy975, Aug 25, 2002.

Thread Status:
Not open for further replies.
Advertisement
  1. astroboy975

    astroboy975 Thread Starter

    Joined:
    Aug 24, 2002
    Messages:
    43
    i've alreadys started discussing this in a different thread, but due to new and disturbing occurences, i felt the need to start a whole separate thread on the matter, i hope that's ok.

    ok, as a background: i did a Panda virus scan yesterday and it found VBS/TheThing in my pc. it was located in the Temporary Internet Files folder. Panda got rid of it. so, fine.

    Today, i decided to do another virus scan just to be thorough, so i run the Panda scanner again. and again it found VBS/TheThing !!!
    location: Temporary internet files\content.IE5 folder.
    don't know how i could've been exposed to it, since the last scan i haven't been to any sites other than here at TSG and Norton, nor have i done any downloading of anything that could be suspect whatsoever. i don't know how i got it again!! and this is what disturbs me further, Panda didn't get rid of it this time; i checked the scan report, and the action taken just said "infected". not deleted or renamed, just 'infected'
    (last scan Panda "renamed" it). why could this be??

    since it was found in the Temp internet files folder, naturally i deleted everything in it. but what i'm wondering is why it keeps coming back?

    and does anyone know exactly about this VBS\TheThing virus?
     
  2. Sponsor

  3. jjb

    jjb

    Joined:
    Dec 8, 2001
    Messages:
    674
  4. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    I don't know where you are getting it from either, but it may be an attempt to exploit this vulnerability...

    http://www.safermag.com/html/safer31/alerts/14.html

    I believe if you are up to date on your IE security patches you have nothing to worry about. It is extremely obscure and hard to take advantage of. It would require an exploitable program to already be downloaded, from what I gather.

    In any case you should definitely install a VBS script monitor or remove Windows Scripting Host from Add/Remove programs as VBS worms of one sort or another abound, and many of them represent serious threats.

    Symantec discusses the options here.

    http://securityresponse.symantec.com/avcenter/venc/data/win.script.hosting.html

    Perhaps even better is the monitoring tool Script Sentry, which protects against other exploits as well....

    http://www.jasons-toolbox.com/scriptsentry.asp

    And since you have no installed antivirus program, you might want to consider AVG, which offers a free, unsupported version:

    http://www.grisoft.com/html/us_downl.htm
     
  5. astroboy975

    astroboy975 Thread Starter

    Joined:
    Aug 24, 2002
    Messages:
    43
    Thanks JJB and Rog,

    i'm sometimes painfully dumb when it comes to 'puters, and believe it or not i hardly know anything about IE security patches!
    Could you please tell me more about it?
    where do i get these patches? how do i set them? or keep them up to date?

    i will visit the sites you recommended right away and also get Script Sentry.

    i'm wondering, would removing Windows Scripting Host cause any drawbacks on my pc? or would it be totally beneficial?
     
  6. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Probably your best bet is to visit the Windows Update site and review the critical security updates that apply to your configuration. There should be a link to it on your Start Menu.

    I don't know of any drawbacks personally, but that's just one option, the others should be sufficient.
     
  7. astroboy975

    astroboy975 Thread Starter

    Joined:
    Aug 24, 2002
    Messages:
    43
    Now that i've uninstalled Windows Scripting Host, is it still necessary to have Script Sentry?
     
  8. Rollin' Rog

    Rollin' Rog

    Joined:
    Dec 9, 2000
    Messages:
    45,855
    Not as far as vbs scripts are concerned, although Script Sentry does provide protections against the running of some other file types as well which can be exploited.
     
  9. astroboy975

    astroboy975 Thread Starter

    Joined:
    Aug 24, 2002
    Messages:
    43
    Thanks Rog!

    i will download Script Sentry then.
     
  10. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/92834