Network.vbs - The Netlog Worm: How to Remove It

Network.VBS or the VBS.Netlog Worm
How to Detect it and Remove It

What is Network.VBS or the Netlog Worm?

Network.VBS is a fairly interesting Visual Basic Scripting worm similar to the infamous LoveLetter (ILOVEYOU) worm. Windows 95, Windows 98, Windows NT, and Windows 2000 machines can be vulnerable to this worm. if the Windows Scripting Host is installed. Most of today's viruses are spread via email and email attachments, however the network.vbs worm is spread through open shares on a computer or computer network.

I had just built a system the day before it attack me and added it to my home network. The new computer probably hadn't been online more than 12 hours when I first noticed a problem. My entire network started to slow down and when attempting to open Network Neighborhood from the infected machine, I couldn't reach any of the other computers on my home network. Upon further investigation, I found the network.vbs file and promptly removed all instances of it. Now this machine was dialing up to the Internet using standard Windows Dial-Up Networking via a 56K modem. It wasn't on some superfast DSL, T1, or cable modem and within 12 hours online was infected.

I use this extreme example of how I was infected to illustrate a point about viruses and Internet security. A worm such as this could be exploited to install remote control tools such as Back Orifice or be used in Distributed Denial of Service attacks such as the attacks that occurred earlier in 2000 against numerous high profile sites. A user could use this sort of worm to compile a list of vulnerable machines then quickly install such remote access tools and cause a lot of destruction.

How Does the Worm Spread?

The worm first opens a log file as c:\network.log and records a copy of all the machines that it attempts to infect. The worm generates a random IP address and records it in the log file, it then attempts to connect the host to the random IP address. If the attempt to connect is unsuccessful it will generate a new IP address and attempt to use that instead. This will continue until it is able to successfully connect to another IP address. Thus the worm spread throughout a computer network or across the Internet virtually undetected.

During infection, Network will remap shared drives on its host to J: and will then copy itself to the file network.vbs which will be created in the following locations:

j:\
j:\windows\startm~1\programs\startup\
j:\windows\
j:\windows\start menu\programs\startup\
j:\win95\start menu\programs\startup\
j:\win95\startm~1\programs\startup\
j:\win95\

By remapping the drives to J: and copying network.vbs to these locations, the worm will automatically be reloaded when the Windows machine is restarted. This file should not be confused with the harmless example VBS file network.vbs that is normally in the "samples\wsh" folder of machines with Windows Scripting Host installed. The worm's network.vbs file is approximately 2.5KB, whereas the WSH example script is over 5KB. This worm will remap drive letters and will generate extra network traffic but does not contain a deliberately destructive payload.

How to Clean/Delete the Network.vbs worm

Cleaning the worm is fairly simple. Using the Windows FIND command located under the Start Menu, search for a file called network.vbs and delete all instances of it EXCEPT the one located in C:\WINDOWS\SAMPLES\WSH which is a harmless example script.

Deleting all instances of the network.vbs file will clean your system of the infection.

** Added September 20, 2000
A Variant of the netlog worm has been found. To clean your system of this variant. Search for network.exe as well as the network.vbs files and delete them. They should be located in the Startup folder. This cleans your system of the Netlog.B variant of the worm.

More Information about Open File and Printer Sharing

Read a great article about File and Printer Sharing and the Internet from PC HELP

http://www.nwi.net/~pchelp/security/issues/sharing.htm

Computer Security and the Internet: How to Protect Yourself