Last night I was called by a friend of mine complaining that he'd somehow severely screwed up Firefox . Every time he clicked on the desktop icon, the following error message popped up:
When it hit me what the error message meant, I explained to him that this was a just a variation of a very old prank and given that he works at a high school it probably wouldn't take long to figure whom was responsible.
I asked him to right click the shortcut and look at the target, assuming that it would be a VBS. To my surprise it was actually pointing to the correct executable.
To make matters worse, it turned out that many of his programs were returning the same error, not just Firefox. He did a quick system restore which had no effect, and after combing through a copy of his registry, I found nothing even remotely amiss. What I did figure out was that the culprit is in fact a VBS because task manager shows the message is being produced by "wscript.exe".
So my question is how does someone reroute a large number of executables in Windows 7 Professional to a wscript host without making any changes to the registry or policy settings? It would have to be a fairly rapid process too, as the laptop is rarely left unattended.
(and if you haven't figured out how this error is profane, look closer at the capitalization)
UPDATE
Well if anyone's curious here's how it was done:
1.) They opened up notepad and typed:
x=msgbox("Fault, User Class KY: Operation Unsupported", 2+16, "Error")
2.) They saved the file as something.vbs
3.) While still in notepad they deleted the previous line and typed in
@echo off
:start
something
GOTO start
4.) They then saved it as somethingelse.bat and used a simple python script to append garbage to the the file so that it's size would match that of the intended target.
5.) Next they compiled the batch produced by step 4 into an exe, gave it the same name, info and icon as the target and then moved it the appropriate folder after moving the original to the trash.
Thankfully they at least had the decency to not empty the trash (which btw still had their python script in it) so in the end it was pretty easy to fix.
