Mscfg.vbs and Hidden Mscfg.exe File in Startup Folder (274339)

SUMMARY

When you view the contents of the Startup folder you may see the Mscfg.vbs file. If you have Windows configured to view hidden files, you may notice the Mscfg.exe file in the Startup folder as well.

These files were not provided by Microsoft, although the file names appear to indicate that these files are associated with the Microsoft System Configuration Utility tool (MSconfig.exe).

If you have these files in your Startup folder, your computer may be infected with the Network.vbs or VBS/Netlog.Worm virus. This worm enables other computer users on the Internet to maliciously gain access to the data stored on your computer.

NOTE: That Network.vbs is the name of the virus and has nothing to do with the actual Microsoft file that may exist on hard drive.

Obtain virus software, or contact your virus software manufacturer for an update that is able to detect and remove this virus from your system.

MORE INFORMATION

This .vbs worm does little but replicate. It attempts to copy itself across a network by first locating shared network drives, and then mapping them to a local drive letter. Once a drive is infected, the worm tries to copy itself to the Windows\Start Menu\Programs\Startup folder of the drive (assuming the infected drive is a Microsoft Windows 95, Microsoft Windows 98, or Microsoft Windows NT system drive) to ensure execution upon startup. The worm remains in the memory until you restart the system.

REFERENCES

Additional information regarding the VBS/Netlog Worm is available at the following Symantec Web site:

http://www.sarc.com/avcenter/venc/data/vbs.network.html

Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

For additional information about computer viruses, click the article number below to view the article in the Microsoft Knowledge Base:

129972 Description of Computer Viruses

NOTE: This virus is created and modified by individuals not associated with Microsoft; customers should contact their antivirus software manufacturer for information regarding the removal of this virus.