This page shows details and results of our analysis on the malware VBS/Count


This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Minimum Engine


File Length


Description Added


Description Modified


Malware Proliferation


The Windows Scripting Host (part of Internet Explorer 5) is required for this virus to function.

When this Visual Basic Script virus is executed, it will modify the "C:\MIRC\SCRIPT.INI" file to instruct mIRC to distribute the worm to others when connecting to a chat room. However, the file specified,

"CounterstrikeRP.TXT                                       .vbs"
(in the "C:\WINDOWS\SYSTEM" directory)
is not created by the actions of this worm and therefore this action will fail. When an infected user quits the mIRC program, a message is displayed:
%Channel% "a|ien rules the base, RP ownz them! ;-)"


Presence of the files mentioned in this description.

Method of Infection

Accidentally or intentionally running this script infects your machine.

The worm copies itself to "c:\WINDOWS\system\RP.TXT.vbs", and "c:\WINDOWS\Start Menu\Programs\StartUp\Startup.vbs"

If the day of the month is 1,5,10,15,20, or 25 the script creates a bitmap image. This is accomplished by creating the files, "C:\WINDOWS\RP.DLL", and "C:\WINDOWS\WINSTART.BAT". The batch file is used to convert the RP.DLL file to RP.BMP. The Wallpaper is then set to "C:\WINDOWS\CounterstrikeRP.BMP", which does not exist.