Odd piece of VBScript [Resolved]

[mendhak]

A friend of mine mentioned that the following scripts were getting added to certain pages when they were loaded in IE. I took a look at it and according to me, it seems to be an activex control with an encoded vbscript script to work with the control.

Your thoughts on what this might be?

REMOVED

Any way that this can be "normalized"?

[Danial]

Here is the Decoded code unformatted...

Removed [Read your PM]

[Danial]

Here is the formatted version, it might have few errors to it, due to the use of both one lined if statement and multilined if statement. But it should give you farily good idea. Took me a while to format it.

[Removed Read your PM]

[Danial]

Hmm formatting looks messed up

Here is the source file..

[Attachmed Removed]

[mendhak]

Good work, thanks. I've removed the code now. Nobody can blame me for anything!!!

[Danial]

Good work, thanks. I've removed the code now. Nobody can blame me for anything!!!

Arent I glad that i saved the script as .txt

Another Virus script to my collection ......

[dglienna]

I wonder if that caused a problem the other day. Anything to do with Outlook Express, by any chance?

[mendhak]

OE?

[dglienna]

I had a problem pointing to OE, which I never even use, and also compiled help. I got rid of them, but it dawned on me that I may have copied your script into notepad. don't think it executed, but its also possible that it was found in the cache of the page that I viewed. I didn't think it was bad script, and I didn't save it.

[dglienna]

I guess you should let others know about it.

[Danial]

I guess you should let others know about it.

No, it had nothing to dd with OE.

After Decoding the Script I realised that it was a virus. Here is more details about the virus in question, http://vil.nai.com/vil/content/v_100329.htm.