Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically


This worm written in Visual Basic Script spreads in e-mail messages using MS Outlook Express. If the Outlook Express does not have the error Scriptlet.Typelib treated, infection may occur also by displaying the message outlook.
Being activated the worm writes itself into the root directory of disk C: or to another position on the disk, into a file with one of the following filenames: Help.htm, Help.vbs, Help.hta. If the sum of the day and month is 13 the worm tries to manipulate files with extensions EXE and DLL.
Subsequently it infects files with extensions HTM, VBA, ASP and HTT on disks. The worm gets e-mail addresses from them and sends a message to them. Subject of the message is "Help ", its body is empty and as an attachment it contains the infected file Untitled.htm. Further on the worm sets the file Help.htm, containing the worm copy, as the desktop wallpaper. It also manipulates Outlook Express setting in the system registry: it uses its own copy as Stationery (it has a function of a template) for e-mail messages which are in HTML format, and it sets this format as a standard one.
In the system registry the worm creates key HKEY_CURRENT_USERSoftwareHelpCount containing a counter. When the counter reaches value 366, the worm sends a message with infected file Untitled.htm in its attachment. The used addresses depend on either even or odd number of seconds: if the number of seconds is even the worm sends the message with infected document to addresses found in the received mail folder. If the number of seconds is odd the worm sends a message with subject "Help" to all e-mail addresses found in contacts.

© 1992-2004 ESET s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.