I received a .vbs file on Skype and ran it.. Please let me know if it does anything?

the code contained

  • 2
    If you think it could be malicious, then you shouldn't just upload it to the internet, if somebody else also run it. Please post the content here, instead of referring to the file itself. Apr 11, 2016 at 12:19
  • 2
    Yes it does something. Why are you running random VBS code?
    – Ramhound
    Apr 11, 2016 at 12:23
  • 1
    Why? Why would you ever run a random VBS script that you got from the internet? I mean, sure, it was Skype, but still. If you do not personally know somebody and have not met them in real life, you should never run a script file from them, especially without understanding how it works.
    – mrdorkface
    Apr 11, 2016 at 14:01
  • 1
    I studied the first half of the script, which outputs and executes another script it creates dynamically. During this phase, Defender identified the 2nd script as "Worm:VBS/Jenxcus.K". I changed the execute instructions to msgbox and outputted the variable to a file. It's a worm.no doubt.
    – w32sh
    Apr 11, 2016 at 17:55
  • @ Máté Juhász - it's just a link to what is contained inside the file, not the file itself.
    – Gigi
    Apr 12, 2016 at 7:29

3 Answers 3


It's obfuscated and you can be damn sure it isn't benign. Consider your computer you ran it on as "not secure" anymore. Which means that don't do any banking on it, don't order anything over the internet, and don't trust that machine at all.

On a different machine, one known not to be compromised, change all your passwords for your accounts and then do not access those accounts from the infected computer.

It would be wise to reformat the computer you ran the script on from known good media preferably with Secure Boot enabled in your BIOS/UEFI when you boot that medium to do so.

  • 1
    @Raystafarian I'm betting odds. He received it over Skype, scammers don't do that kind of things for the lulz, to err on the safe side is to assume it's malicious.
    – headkase
    Apr 11, 2016 at 12:25
  • Also, from what I saw of the code before it was edited out, there was a bunch of random looking variables defined. I don't know how to script VBS, but I would assume the variables were made gibberish to confuse someone trying to read it, which implies that the file is malicious- if it didn't do anything bad, why make it hard to understand? @Raystafarian
    – mrdorkface
    Apr 11, 2016 at 14:23
  • @Raystafarian It has been decoded. See the other answer.
    – DavidPostill
    Apr 11, 2016 at 14:36
  • I'm obviously not communicating clearly enough to get my point across, sorry. Apr 11, 2016 at 14:37

If you're still worried about what might have happened to your computer, take a look at this ( lines are left as strings for security reason ). Do not try to execute this code If you don't know what you're doing. I'm at work atm so I can't analyze this code in depth but it doesn't seem good. From a quick overview i found that there's

  • File and folder tampering
  • Registry tampering ( especially start up programs )
  • Sending requests ( I noticed one particular domain - kingprog.publicvm.com, but there may be many others)
  • Drive tampering

You might want to ask someone to check this out or wait for a few hours till I get home and I'll get back to you with more info.

I would still strongly advise you follow headkase's advice.

EDIT In case it's not clear, the attached link is the deobfuscated vbs code

  • 1
    I attempted to visit the domain through tor, and all that happened was it said the site was unavailable. Perhaps this is an old file and the site it references is no longer active?
    – mrdorkface
    Apr 11, 2016 at 14:18
  • 1
    @mrdorkface - It is not safe. Please don't visit known malicious websites nor run unknown code on purpose..
    – Ramhound
    Apr 11, 2016 at 14:18
  • Alright. Tor has scripts disabled, so the risk seemed low. (also, if my school laptop gets infected, its all the better for me- I have an excuse to wipe it so i can use it for whatever I want.) @Ramhound
    – mrdorkface
    Apr 11, 2016 at 14:21

I decoded this vbscript code !

The suspicious file is located on this folder %Appdata%

And check on your registry for any suspicious entry on :




I worte a vbscript that can found any suspicious vbscript file running in the background.

So, this code can retrieve the location and copy the source code of this suspicious vbscript file : Just, copy and paste as Find_any_Running_VbsCode.vbs and run it by double clic :

Option Explicit
Dim Title,colItems,objItem,FilePath,ws
Dim MyProcess,LogFile,fso,Contents,arrCommandLine
MyProcess = "Wscript.exe"
Title = "Searching for instances of "& DblQuote(MyProcess) &" by Hackoo 2016"
Set fso = CreateObject("Scripting.FileSystemObject")
Set ws = CreateObject("WScript.Shell")
LogFile = Left(Wscript.ScriptFullName, InstrRev(Wscript.ScriptFullName, ".")) & "txt"
If fso.FileExists(LogFile) Then
End If
Set colItems = GetObject("winmgmts:").ExecQuery("Select * from Win32_Process " _
& "Where Name like '%"& MyProcess &"%' AND NOT commandline like '%" & wsh.scriptname & "%'",,48)
For Each objItem in colItems
    arrCommandLine = Split(objItem.CommandLine,DblQuote(" "))
    'msgbox objItem.CommandLine
    If arrCommandLine(1) = "/c" Then 
    'msgbox arrCommandLine(2)
        FilePath = Replace(arrCommandLine(2),chr(34),"")
    'msgbox arrCommandLine(1)
        FilePath = Replace(arrCommandLine(1),chr(34),"")
    end if 
    FilePath = Trim(FilePath)
    Msgbox "A suspicious file is running at this location : " & vbCrLF & DblQuote(FilePath),vbExclamation,Title
    If Len(FilePath) > 0 Then   
        Contents = ReadFile(FilePath,"all")
        Call WriteLog(DblQuote(FilePath) & vbCrlf & String(100,"*")& vbCrlf &_
        Contents & vbCrlf & String(100,"*") & vbCrlf,LogFile)
    End If  
If fso.FileExists(LogFile) Then
    ws.run DblQuote(LogFile)
    MsgBox "No running instances found for this process " &_
End If  
Function DblQuote(Str)
    DblQuote = Chr(34) & Str & Chr(34)
End Function
Function ReadFile(path,mode)
    Const ForReading = 1
    Dim objFSO,objFile,i,strLine
    Set objFSO = CreateObject("Scripting.FileSystemObject")
    Set objFile = objFSO.OpenTextFile(path,ForReading)
    If mode = "byline" then
        Dim arrFileLines()
        i = 0
        Do Until objFile.AtEndOfStream
            Redim Preserve arrFileLines(i)
            strLine = objFile.ReadLine
            strLine = Trim(strLine)
            If Len(strLine) > 0 Then
                arrFileLines(i) = strLine
                i = i + 1
                ReadFile = arrFileLines
            End If  
    End If
    If mode = "all" then
        ReadFile = objFile.ReadAll
    End If
End Function
Sub WriteLog(strText,LogFile)
    Dim fso,ts 
    Const ForAppending = 8
    Set fso = CreateObject("Scripting.FileSystemObject")
    Set ts = fso.OpenTextFile(LogFile,ForAppending,True,-1)
    ts.WriteLine strText
End Sub

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .