Remove Virus: How to Remove the Network.vbs Worm

An Overview of this Email Virus and Steps to Uninstall it

Aug 19, 2008

Network.vbs is a virus worm written in Visual Basic Scripting (VBS). Here's an overview of this worm and the steps you need to uninstall the Network.vbs

The Network.vbs or Netlog worm is a Visual Basic Scripting worm very similar to the vastly popular ILOVEYOU (also known as the Love Letter) worm. This virus mostly infects Windows operating systems.

Windows 95, Windows 98, Windows NT, and Windows 2000 are especially susceptible to this worm. The risk is increased if the Windows Scripting Host is installed.

How the Network.vbs Virus Does its Dirty Work

Unlike most of today’s viruses, which are spread through email attachments, the network.vbs worm is spread via open shares on a single computer or a multiple-system network. The network.vbs worm opens a log file as C:\network.log and records a copy of all the computers it attempts to infect.

The worm then creates a random IP address and records it in the log file. After this, it attempts to connect the host to the random IP address it generated. If the connection attempt is unsuccessful, a new IP address will be generated and the virus will try to connect the host to that IP address.

This process will be repeated until the worm successfully connects to another IP address. This enables the network.vbs worm to transmit and spread itself across a computer network and across the Internet very quickly without detection.

When a computer is infected, network.vbs will remap shared drives on its host to drive J. After that, it will then copy itself to a file called network.vbs. The file is then copied to the following directories:

The purpose of remapping the drives to J: and copying the file network.vbs to these locations is so that the worm can automatically be reloaded when the Windows computer reboots.

It is important not to confuse this file will the harmless example Visual Basic file network.vbs that is normally in the sample\wsh directory of most Windows computers that have Windows Scripting Host installed. The malicious file is approximately 2.5 kilobytes and the legitimate file is well over 5 kilobytes. The virus will remap drive letters and will generate extra network traffic.

The network.vbs worm is not as dangerous as other viruses, but is still recommended that this worm is removed.

How to Remove the Network.vbs Virus

The user should also check if there are any files named network.exe, as this is a variant of the worm.

The copyright of the article Remove Virus: How to Remove the Network.vbs Worm in Internet Security is owned by Dianna Monda Dill. Permission to republish Remove Virus: How to Remove the Network.vbs Worm in print or online must be granted by the author in writing.