Re: Has anyone else seen/encountered the "VBS.Network" virus? I just did.

[ebrockway () EARTHLINK NET (Erick Brockway)]

    The only thing I could find at either NAI or SARC was this at NAI:

Virus Profile

Virus Name
VBS/Netlog.worm

Date Added
2/3/00

Virus Characteristics
This is a new Internet-aware VBScript worm. The sample Avert received is
2,429 bytes long. The interesting thing about it is that a person does not
have to manually run a VBScript file, or read an e-mail message to get
infected; it spreads over open network shares.
 more: http://vil.mcafee.com/vil/vbs98477.asp

-----Original Message-----
From: Olaf Black <olaf_black () HOTMAIL COM>
To: INCIDENTS () SECURITYFOCUS COM <INCIDENTS () SECURITYFOCUS COM>
Date: Monday, February 28, 2000 1:45 PM
Subject: Has anyone else seen/encountered the "VBS.Network" virus? I just
did.

Hello all:

Norton Antivirus just popped up an alert indicating that it had found a
file:

C:\Windows\TEMP\tmpB214.TMP

That had been infected with the "VBS.Network" virus.

Norton first asked me if I wanted to repair the file.  Since this was the
"recommended" procedure from Norton, I went ahead and let NAV attempt to
repair the file.

NAV then came back and told me that the file could not be repaired, and that
the next "recommended" course of action would be to "quarantine" the file so
I went ahead and NAV came back and said that it successfully quarantined the
file.

With that, I have some questions.

What is the "VBS.Network" virus?  What does it do exactly?  What does
"quarantining" an infected file do?  Does it mean a file is moved off into a
"safe" directory and modified in some way?

Thanks,

Olaf