Threat Explorer

The Threat Explorer is a comprehensive resource consumers can turn to for daily, accurate, up-to-date information on the latest threats, risks and vulnerabilities.



06 March 2001
13 February 2007

VBS.Sppst is a virus written in the Visual Basic scripting language.

Antivirus Protection Dates

  • Initial Rapid Release version 06 March 2001
  • Latest Rapid Release version 28 September 2010 revision 054
  • Initial Daily Certified version 06 March 2001
  • Latest Daily Certified version 28 September 2010 revision 036
  • Initial Weekly Certified release date pending
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

The virus attempts to propagate by infecting files that have the .vbs extension and that are in the same folder as the virus. However, because this is the only way that this virus can propagate, it is highly unlikely that it will spread.

The author of this virus tried to make his creation polymorphic, and by definition, this virus is polymorphic. However, the virus changes itself by inserting random comments between its own lines of code. This change does not cause any problems for Norton AntiVirus in the detection of the virus.

Before attempting to infect a file, this virus checks for the comment ''SPPST." If found, the virus will not infect the file. This appears to be an attempt to avoid infecting the same file multiple times.

To remove this virus:
  1. Run LiveUpdate to make sure that you have the most recent virus definitions.
  2. Start Norton AntiVirus (NAV), and run a full system scan, making sure that NAV is set to scan all files.
  3. Delete any files detected VBS.Sppst.

Writeup By: Neal Hindocha