Viral Scripts - VBS

[dickey]

Has anyone encountered a VBS Worm by the name of "Cool USEP Sex Scandal" or "Nude SSG Sex Scandal" if the answer is yes can you PM me please I want to ask you to email the original file or script of the worm the one that is encrypted.

Thanks
Edit:
Oh and if anybody got infected with this it is known as sowar virus. I can be of help in removing it. And another variant wherein the script file name is auto.vbs...

Symptoms for both worms are these.

1. Cannot open task manager (Ctrl-Alt-Del)
2. Cannot run Registry Editor (Start -> Run -> "Regedit")

Auto.vbs Specific:

Upon windows startup the error of auto.vbs not found...

Sowar.vbs Specific

Browser (mostly IE) title bar contains Sowar Browser or long live sowar.

This scripts usually spread by removable media.

[Twinkie]

Uh, I'm not sure this is in the rules. I had that virus when I was oblivious to security and had to format. I can't help you with that.

[dickey]

I am just asking for information as I want to counter the effect of the worm.

To the mods if this topic is in violation of the rules please delete the thread. Though I can help to undo the effects of the worm though. I am particularly interested in the simple encryption of the sowar worm and am thinking of adapting the encryption to php and provide security to my data.
Edit:

Function Decrypt(strInput)
	strInputCopy = strInput
	strInputCopy = Replace(strInputCopy, Chr(28), String(3, Chr(9)))
	strInputCopy = Replace(strInputCopy, Chr(27), String(3, Chr(32)))
	strInputCopy = Replace(strInputCopy, Chr(29), vbCrLf)
	strInputCopy = Replace(strInputCopy, Chr(18), Chr(34))
	
	
	d = Left(strInputCopy, InStr(1, strInputCopy, Chr(25)) - 1)
	strInputCopy = Mid(strInputCopy, Len(d) + 2, Len(strInputCopy))
	e = 1
	f = 0
	For i = 1 To Len(d) / 2
		g = Mid(d, e, 2)
		strInputCopy = Replace(strInputCopy, Chr(128 + f), g)
		e = e + 2
		f = f + 1
	Next
	a = strInputCopy
End Function

This vbs script will provide decryption. I want the whole file so as to create an equivalent Encrypt() function to enable me to encrypt some file and use this decryption to decrypt it, unless someone is able to create an encryption process based on this code snippet...
Edit:

Function Encrypt(a)
    b = a
	

	
	b = Replace(b, Chr(34), Chr(18))
	b = Replace(b, vbCrLf, Chr(29))
	b = Replace(b, String(3, Chr(32)), Chr(27))
	b = Replace(b, String(3, Chr(9)), Chr(28))
End Function

I am stumped here.