Assigned Zemana Found a worm in gatherNetworkInfo.vbs which i'm baffled by

[pneuma1985]

Well i schedule zemana b/c I use at as on demand scanner and It popped up with this tonight.
gatherNetworkInfo.vbs
Status : Scanned
Object : %systemroot%\system32\gathernetworkinfo.vbs
MD5 : 2AE808CB0D9A667B0CF41EA74B3B9BAC
Publisher : -
Size : 40552
Version : -
Detection : Worm:VBS/Akuza!Es
Cleaning Action : Repair
Traces :
File - %systemroot%\system32\gathernetworkinfo.vbs

And God I hate worms. I have not downloaded any malware in some time b/c I did a clean slate on my workstation about a month ago. Its not running and risky software at all everything that could possibly be exploited is in a VM... I don't get it hopefully someone can point me in the right direction on removing this?

 

[pneuma1985]

Well i schedule zemana b/c I use at as on demand scanner and It popped up with this tonight.
gatherNetworkInfo.vbs
Status : Scanned
Object : %systemroot%\system32\gathernetworkinfo.vbs
MD5 : 2AE808CB0D9A667B0CF41EA74B3B9BAC
Publisher : -
Size : 40552
Version : -
Detection : Worm:VBS/Akuza!Es
Cleaning Action : Repair
Traces :
File - %systemroot%\system32\gathernetworkinfo.vbs

And God I hate worms. I have not downloaded any malware in some time b/c I did a clean slate on my workstation about a month ago. Its not running and risky software at all everything that could possibly be exploited is in a VM... I don't get it hopefully someone can point me in the right direction on removing this?

This is killing me I either caught a persistent backdoor or I keep getting pwned one or the other.

 

[pneuma1985]

I am about to dban my drives seriously its pissing me off I have to be root kitted there's no other way since I don't even download things on my host machine just necessary security config and acronis and cyberfox everything else is done in my VM secondary os BC I develop in it... Driving me insane two infections in two weeks! Need help with rootkits removal and actually finding it BC tdskiller didnt and its an ssd drive so I'm limited in the tools I can use some are HDD only.

 

[OokamiCreed]

It's a false positive. I've checked the code of my own vbs script in the same exact location and it checked out fine. VirusTotal gives no detection with all 54 engines. I've scanned it with Zemana and it detected it the same as yours.

There is no private information in this file. My MD5 hash is: 2AE808CB0D9A667B0CF41EA74B3B9BAC

This hash matches yours. They are the same exact file. If I'm not mistaken, Zemana has it's own engine. That is probably what is detecting it.

 

[LabZero]

The gathernetworkinfo.vbs script comes by default with every Windows 7 installation and is located within the C:\Windows\System32\ folder.

The script does collect various networking information about the Windows 7 system and its configuration and dumps the information into the C:\Windows\System32\Config folder, but it is not a worm.

The GatherNetworkinfo.vbs Script

 

[frogboy]

Well thanks @Klipsh that explains why it showed up on my W7 machine but not my W10 machine.

 

[RmG152]

The gathernetworkinfo.vbs script comes by default with every Windows 7 installation and is located within the C:\Windows\System32\ folder.

The script does collect various networking information about the Windows 7 system and its configuration and dumps the information into the C:\Windows\System32\Config folder, but it is not a worm.

The GatherNetworkinfo.vbs Script

Well thanks @Klipsh that explains why it showed up on my W7 machine but not my W10 machine.

I have a clean installation of Windows 10 and I have this script, but with different hash (and not detected by zemana)

MD5 0fee8db559981d7f06e26042ecd8d671
SHA1 aa5de05b7c5265cb17551930f33981c078680515
SHA256 e4265c3c486938566f6c95e43a2db4f4383cfa3e6ca8197727e0e8df97a9cfb5

 

[porkpiehat]

lol... I was just about to post the same problem.... big sigh of relief!!

 

[jamescv7]

It detects as worm because of the nature where the file is made on script and usually there are some codes that nearly same behavior on suspicious, if you didn't mess something and the sample is valid to be on system32 hence it can be a false positive unless you know some situation where manipulation may occur.

 

[Ink]

Well thanks @Klipsh that explains why it showed up on my W7 machine but not my W10 machine.

Not detected on Windows 8.1 either.

 

[Deleted Member 333v73x]

False Positive, tagging @iIda15 so it can be fixed

 

[Cats-4_Owners-2]

False Positive, tagging @iIda15 so it can be fixed

Thank you, @Tornado.
Reporting quashes fear as well as future false positives.

 

[iIda15]

False Positive, tagging @iIda15 so it can be fixed

-Thanks @Tornado, we will look into it and get it fixed.

 

[Deleted Member 333v73x]

-Thanks @Tornado, we will look into it and get it fixed.

No problem @iIda15 I just want to help

 

[iIda15]

No problem @iIda15 I just want to help

 

[Azure]

Well thanks @Klipsh that explains why it showed up on my W7 machine but not my W10 machine.

Lol. I should have read this before. I wasted some time trying scan the system32 folder with Zemana

 

[iIda15]

@everyone: Fixed!

Have a great weekend!

 

[Deleted Member 333v73x]

@everyone: Fixed!

Have a great weekend!

That was fast, one of the million reasons why I like Zemana

 

[iIda15]

That was fast, one of the million reasons why I like Zemana

-Thank you Really nice of you @Tornado

 

[pneuma1985]

Just reimaged my pc and now it doesnt show up as malware! Just saying...Oh and it has a different md5 sum!

Hypothetically speaking it is possible that file is a new target for a worm we can't know if its an unknown in the wild script modifying that file?