Jump to content


Register a free account to unlock additional features at BleepingComputer.com
Welcome to BleepingComputer, a free community where people like yourself come together to discuss and learn how to use their computers. Using the site is easy and fun. As a guest, you can browse and view the various discussions in the forums, but can not create a new topic or reply to an existing one unless you are logged in. Other benefits of registering an account are subscribing to topics and forums, creating a blog, and having no ads shown anywhere on the site.

Click here to Register a free account now! or read our Welcome Guide to learn how to use this site.


Nar.vbs - What Is It?

  • Please log in to reply
1 reply to this topic

#1 spudeleven


  • Members
  • 1 posts
  • Local time:11:10 PM

Posted 16 August 2008 - 10:35 AM


Trying to learn more about nar.vbs - it propagates via thumb drives / usb, but I'm not seeing anything about what it does or whether it's linked to anything more insidious.

All I've seen so far is information on how to remove it. That's not enough. My enterprise has this bug going around, and my management wants more details about it.

Norton, McAfee, etc. don't list it, although there is a McAfee definition listed in the registry on those machines getting updates from our local ePO replication database.


BC AdBot (Login to Remove)


#2 Animal


    Bleepin' Animinion

  • Members
  • 35,905 posts
  • Gender:Male
  • Location:Where You Least Expect Me To Be
  • Local time:01:10 PM

Posted 16 August 2008 - 12:40 PM

It is identified as a Visual Basic Script Worm. Without more information as to file location and other factors it is impossible to tell what the worm does.

I would suggest you post in the Am I Infected forum with as much information regarding this file, as possible. There you will get assistance from more knowledgeable members regarding potentially nefarious files, and how to deal with them.

According to a web search and finding a submission to Virus Totals many vendors do not identify this file:

File Nar.vbs received on 07.08.2008 12:08:10 (CET)
Antivirus Version Last Update Result
AhnLab-V3 2008.7.8.0 2008.07.08 -
AntiVir 2008.07.08 HEUR/HTML.Malware
Authentium 2008.07.07 -
Avast 4.8.1195.0 2008.07.07 -
AVG 2008.07.08 VBS/Small
BitDefender 7.2 2008.07.08 Generic.ScriptWorm.51607B57
CAT-QuickHeal 9.50 2008.07.07 -
ClamAV 0.93.1 2008.07.08 -
DrWeb 2008.07.08 SCRIPT.Virus
eSafe 2008.07.07 -
eTrust-Vet 31.6.5937 2008.07.08 VBS/SillyAutorunScript.L
Ewido 4.0 2008.07.07 -
F-Prot 2008.07.07 -
F-Secure 7.60.13501.0 2008.07.08 Type_Script
Fortinet 2008.07.07 -
GData 2.0.7306.1023 2008.07.08 -
Ikarus T3. 2008.07.08 Generic.ScriptWorm
Kaspersky 2008.07.08 Type_Script
McAfee 5333 2008.07.07 -
Microsoft 1.3704 2008.07.08 -
NOD32v2 3249 2008.07.08 VBS/AutoRun.S
Norman 5.80.02 2008.07.07 -
Panda 2008.07.08 -
Prevx1 V2 2008.07.08 -
Rising 2008.07.08 Unknown Script Virus
Sophos 4.31.0 2008.07.08 -
Sunbelt 3.1.1509.1 2008.07.04 -
Symantec 10 2008.07.08 VBS.Runauto
TheHacker 2008.07.07 -
TrendMicro 8.700.0.1004 2008.07.08 VBS_AUTORUN.CAJ
VBA32 2008.07.07 -
VirusBuster 2008.07.07 -
Webwasher-Gateway 6.6.2 2008.07.08 Heuristic.HTML.Malware

The Internet is so big, so powerful and pointless that for some people it is a complete substitute for life.
Andrew Brown (1938-1994)

A learning experience is one of those things that say, "You know that thing you just did? Don't do that." Douglas Adams (1952-2001)

"Imagination is more important than knowledge. Knowledge is limited. Imagination circles the world." Albert Einstein (1879-1955)

Follow BleepingComputer on: Facebook | Twitter | Google+

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users