Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Last night I was called by a friend of mine complaining that he'd somehow severely screwed up Firefox . Every time he clicked on the desktop icon, the following error message popped up:

error message

When it hit me what the error message meant, I explained to him that this was a just a variation of a very old prank and given that he works at a high school it probably wouldn't take long to figure whom was responsible.

I asked him to right click the shortcut and look at the target, assuming that it would be a VBS. To my surprise it was actually pointing to the correct executable.

To make matters worse, it turned out that many of his programs were returning the same error, not just Firefox. He did a quick system restore which had no effect, and after combing through a copy of his registry, I found nothing even remotely amiss. What I did figure out was that the culprit is in fact a VBS because task manager shows the message is being produced by "wscript.exe".

So my question is how does someone reroute a large number of executables in Windows 7 Professional to a wscript host without making any changes to the registry or policy settings? It would have to be a fairly rapid process too, as the laptop is rarely left unattended.

(and if you haven't figured out how this error is profane, look closer at the capitalization)

Update

Well if anyone's curious here's how it was done:

  1. They opened up notepad and typed:

    x=msgbox("Fault, User Class KY: Operation Unsupported", 2+16, "Error")  
    
  2. They saved the file as something.vbs

  3. While still in notepad they deleted the previous line and typed in

    @echo off
    :start
    something
    GOTO start
    
  4. They then saved it as somethingelse.bat and used a simple python script to append garbage to the the file so that it's size would match that of the intended target.

  5. Next they compiled the batch produced by step 4 into an exe, gave it the same name, info and icon as the target and then moved it the appropriate folder after moving the original to the trash.

Thankfully they at least had the decency to not empty the trash (which btw still had their python script in it) so in the end it was pretty easy to fix.

share|improve this question
1  
maybe try to figure out why some EXEs are affected and not others. What if you take a notepad.exe you know is legit, and put it in the same directory as an exe you know is bad. and try changing the name of the exe see if it makes any difference. and see if safe mode makes any difference. –  barlop May 8 '11 at 2:57
    
Looks like a couple of things they all have in common is that none of them are protected system files and none came bundled with the os. I tried the EXE swap like you suggested (good thinking) and discovered that the new exe with the same name ran fine. What's odd though is that the original EXEs that I've looked at are exactly the size that they should be (Firefox for instance is 891k on both his laptop and mine). But at least this shows it's a problem with the files themselves. –  Blomkvist May 8 '11 at 4:15
2  
I guess to me, the bigger question is, how did somebody get unrestricted access to his laptop for long enough for this to happen? Especially if you work in an environment like a high school, it's irresponsible not to lock your computer when you get up to leave. I'd suggest you take this opportunity to remind him that it's really quite easy to lock the computer, and that he should. –  nhinkle May 10 '11 at 1:49
    
Re your update. Did you see them doing all this? You were running the compiled VBS I suppose. Did you never run the compiled BAT? What was the "something" between :start and GOTO Start ? –  barlop May 15 '11 at 18:28
    
Calm down, barlop,I know the mysterious and complex world of batch files can be frustrating but I'll walk you through it. If you include a string like "something" in a batch it will look for an executable by that name. In the explanation above do you see an executable named "something"? There you go. –  Blomkvist May 15 '11 at 18:58

1 Answer 1

up vote 2 down vote accepted

(I know it's to do with the registry, but...) they may have changed the Image File Execution Options for common executables. See here for an example of replacing notepad.exe with notepad2.exe.

share|improve this answer
    
Thanks, Taspeotis, that's one I didn't check. Unfortunately there's only a couple of keys there (DllNXoptions and IEinstal) and they're both as they should be. –  Blomkvist May 8 '11 at 1:26
    
Thanks again for the input. Even though the registry turned out to be alright, this and barlop's suggestion put me on the right track. –  Blomkvist May 10 '11 at 1:34
    
@Blomkvist - no problems, although you should add your UPDATE above as an answer and mark it as the answer. –  ta.speot.is May 10 '11 at 7:07
    
Then there’s the AppInit_DLLs, key and so on. Whenever weird stuff like this happens, it’s best to first run Autoruns and HijackThis to see what’s there and look for suspicious things—a lot of the time, you’ll find the problem in one of these. (A lot of people jump to recommending all kinds of anti-malware apps, but anyone with a modicum of computer knowledge should look first before running those things since those are more for changing (aka “fixing”) things as opposed to just examining. –  Synetech May 14 '11 at 0:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.