Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.

Photo

Nar.vbs - What Is It?


  • Please log in to reply
1 reply to this topic

#1 spudeleven

spudeleven

  • Members
  • 1 posts
  • OFFLINE
  •  
  • Local time:07:42 AM

Posted 16 August 2008 - 10:35 AM

Hello,

Trying to learn more about nar.vbs - it propagates via thumb drives / usb, but I'm not seeing anything about what it does or whether it's linked to anything more insidious.

All I've seen so far is information on how to remove it. That's not enough. My enterprise has this bug going around, and my management wants more details about it.

Norton, McAfee, etc. don't list it, although there is a McAfee definition listed in the registry on those machines getting updates from our local ePO replication database.

Thanks!

BC AdBot (Login to Remove)

 


#2 Animal

Animal

    Bleepin' Animinion


  • Site Admin
  • 25,878 posts
  • ONLINE
  •  
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:10:42 PM

Posted 16 August 2008 - 12:40 PM

It is identified as a Visual Basic Script Worm. Without more information as to file location and other factors it is impossible to tell what the worm does.

I would suggest you post in the Am I Infected forum with as much information regarding this file, as possible. There you will get assistance from more knowledgeable members regarding potentially nefarious files, and how to deal with them.

According to a web search and finding a submission to Virus Totals many vendors do not identify this file:

File Nar.vbs received on 07.08.2008 12:08:10 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.7.8.0 2008.07.08 -
AntiVir 7.8.0.64 2008.07.08 HEUR/HTML.Malware
Authentium 5.1.0.4 2008.07.07 -
Avast 4.8.1195.0 2008.07.07 -
AVG 7.5.0.516 2008.07.08 VBS/Small
BitDefender 7.2 2008.07.08 Generic.ScriptWorm.51607B57
CAT-QuickHeal 9.50 2008.07.07 -
ClamAV 0.93.1 2008.07.08 -
DrWeb 4.44.0.09170 2008.07.08 SCRIPT.Virus
eSafe 7.0.17.0 2008.07.07 -
eTrust-Vet 31.6.5937 2008.07.08 VBS/SillyAutorunScript.L
Ewido 4.0 2008.07.07 -
F-Prot 4.4.4.56 2008.07.07 -
F-Secure 7.60.13501.0 2008.07.08 Type_Script
Fortinet 3.14.0.0 2008.07.07 -
GData 2.0.7306.1023 2008.07.08 -
Ikarus T3.1.1.26.0 2008.07.08 Generic.ScriptWorm
Kaspersky 7.0.0.125 2008.07.08 Type_Script
McAfee 5333 2008.07.07 -
Microsoft 1.3704 2008.07.08 -
NOD32v2 3249 2008.07.08 VBS/AutoRun.S
Norman 5.80.02 2008.07.07 -
Panda 9.0.0.4 2008.07.08 -
Prevx1 V2 2008.07.08 -
Rising 20.52.12.00 2008.07.08 Unknown Script Virus
Sophos 4.31.0 2008.07.08 -
Sunbelt 3.1.1509.1 2008.07.04 -
Symantec 10 2008.07.08 VBS.Runauto
TheHacker 6.2.96.374 2008.07.07 -
TrendMicro 8.700.0.1004 2008.07.08 VBS_AUTORUN.CAJ
VBA32 3.12.6.8 2008.07.07 -
VirusBuster 4.5.11.0 2008.07.07 -
Webwasher-Gateway 6.6.2 2008.07.08 Heuristic.HTML.Malware


The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown


Posted Image


A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams.


"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)


Follow BleepingComputer on: Facebook | Twitter | Google+





0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users