Microsoft KB Archive/274339

= Mscfg.vbs and Hidden Mscfg.exe File in Startup Folder =

Article ID: 274339

Article Last Modified on 1/29/2007

-

APPLIES TO


 * Microsoft Windows Millennium Edition
 * Microsoft Windows 98 Standard Edition
 * Microsoft Windows 98 Second Edition

-



This article was previously published under Q274339



SUMMARY
When you view the contents of the Startup folder you may see the Mscfg.vbs file. If you have Windows configured to view hidden files, you may notice the Mscfg.exe file in the Startup folder as well.

These files were not provided by Microsoft, although the file names appear to indicate that these files are associated with the Microsoft System Configuration Utility tool (MSconfig.exe).

If you have these files in your Startup folder, your computer may be infected with the Network.vbs or VBS/Netlog.Worm virus. This worm enables other computer users on the Internet to maliciously gain access to the data stored on your computer.

NOTE: That Network.vbs is the name of the virus and has nothing to do with the actual Microsoft file that may exist on hard drive.

Obtain virus software, or contact your virus software manufacturer for an update that is able to detect and remove this virus from your system.



MORE INFORMATION
This .vbs worm does little but replicate. It attempts to copy itself across a network by first locating shared network drives, and then mapping them to a local drive letter. Once a drive is infected, the worm tries to copy itself to the Windows\Start Menu\Programs\Startup folder of the drive (assuming the infected drive is a Microsoft Windows 95, Microsoft Windows 98, or Microsoft Windows NT system drive) to ensure execution upon startup. The worm remains in the memory until you restart the system.

