MS32DLL.dll.vbs on SD card

[jim]

I've been given a SD card that has this file in the root... I didn't recognise it, and opening up in text editor it shows a lot of mucking around with the registry and boot.ini

Is it a standard file used on USB devices like autorun.inf?

All my googling indicates it's a virus, but a couple of scans picked up nothing and I know how people like to pick up a file name and say "it's a virus!" even when it's a legit file that's just happened to become infected on one or two occasions.

However, I can't find anything on google to suggest it's legit either... does anybody know? I don't use portable storage very often so I couldn't honestly say whether it's normal or not... just doesn't seem right.

[jim]

Hmm... just looking at it in notepad now, the following part doesn't look good to me

loop
Set winpath = fs.getspecialfolder(0)
set tf = fs.getfile(winpath & "\.MS32DLL.dll.vbs")
tf.attributes = 32
set tf=fs.createtextfile(winpath & "\.MS32DLL.dll.vbs",2,true)
tf.write "'ker"&vbcrlf&mysource
tf.close

I don't know exactly what it's doing, but I take it that is copying itself to the windows directory... which can't be normal practice

[mycarsavw]

VBS.Zodgila worm

http://www.techiecorner.com/122/hack...ms32dlldllvbs/

Run away!

[jim]

Yeah, the more I look at that info and the vbs file the more stuff they seem to have in common.

I'm getting shut of it, going back to sender I think.