Your computer has been infected with H-Worm by Houdini.
The VBS file on your computer consists of two parts; first, the actual malware, encoded as Base64 as said by user2867314; second, the code to Base64-decode the malware.
Step by step:
- The first line is a comment.
The next line calls the function
deCrypt with the Base-64 encoded malware and assigns the return value to a variable with the name
Safa7_22 = deCrypt("(…)")
The third line executes the value of the variable
Safa7_22 as VBScript:
- Line 4-6 contain a function named
deCrypt that, when called, calls another function named
decodeBase64 with the data passed as the first argument to the
deCrypt function and returns the value returned by the
decodeBase64 function. It is redundant, as the malware author could just have called the function
decodeBase64 directly at line two. Since VBScript first makes all functions in a script available before it starts with the execution of the other code, it is available at line two.
- Line 7-49 contain a function to decode Base64, apparently copied from here.
The malware is encoded to hamper detection by AntiVirus solutions.
Here is the original malware with the correct syntax highlighting: http://pastebin.com/ne1fnwKx
And here is the the decoded malware: http://pastebin.com/7qS5rEEQ
At the top at the decoded malware is the configuration: it is configured to communicate with its C&C at
Right now, this subdomain points to a server at
18.104.22.168, a server hosted by an ISP in Mumbai, India.
It will use port
1155 and is configured to hide both folders and files and replace them with shortcuts.
When the malware is base64-decoded and executed, it performs the following actions.
It first calls the function
instance. This function checks if the computer already has a flag in the Windows registry. If not, it will store the following:
a. If the script is in the root directory of a drive, it will set store the value "true" and the current date.
b. If the script is not in the root directory of a drive, it will set store the value "true" and the current date.
After that, the function
instance calls another function,
upstart. This function creates a key in the Windows registry under
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\ to ensure the script is started each time when you're logging in to your account if you weren't logged in yet. It also copies itself to the Startup folder.
Then, this function ends and the function
instance resumes execution. It checks if it is already installed at the configured install location and, if so, starts WScript in Batch mode with the script's name and exits.
- It then uses the
OpenTextFile function to try top open a copy of the script at the install location. If opening fails, the script is already executing, meaning there is no need to reinstall it. Thus, if there is an error, it quits.
instance has now stopped execution, and the scripting engine resumes at line 42, where it encounters the following instruction:
This is the beginning of an infinite loop, meaning the script will stay running until it breaks out of the loop (or the script is terminated).
After that, it calls the function
install. This function first calls the
upstart function, described above, again. After that, it will do the following for each drive:
- If configured so, it hides files and / or folders and replaces them with a shortcut that will first execute the malware and then open the original file / folder using Windows Explorer.
- Then, it will send an HTTP POST request request to the C&C server. It can perform various actions: downloading and executing arbitrary programs, updating itself, executing CMD commands, kill processes, send information about the drive and running processes to the attacker and more. It also contains an action to uninstall itself. All of this happens over an unencrypted (HTTP) connection.
- Once it has executed the attackers commands, if there were any, it will halt execution for a specified amount of time (in this case, 5 seconds). Then, it encounters the instruction
wend, after which it will start over at the beginning of the
while loop (see point 5).
How to remove:
wscript.exe using Task Manager or Process Explorer.
- Show hidden folders if you haven't done so already.
- Remove any malicious
.lnk files left behind by the script.
- Delete the script's entry under
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\. It will be the script's name without
- Remove the script from the windows startup folder.
- Clean the other registry keys left behind by the script as well if you want.
- Remove the script file from the root of each portable disk drive and the install directory (
- Make the hidden files and folders visible again.
- Malware almost never comes alone. Run a full system scan with an antivirus and a second opinion scanner (such as MalwareBytes and HitmanPro). Also, consider a full reinstall of your system.