Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

VBS/Haptime

VBS/Haptime is a worm written in Visual Basic Script and spreads in email messages using MS Outlook Express.  If Outlook Express has not been patched for the Scriptlet.Typelib vulnerability, infection may occur also by simply displaying the message in outlook.  Being activated the worm writes itself into the root directory of disk C: or to another position on the disk, into a file with one of the following filenames: Help.htm, Help.vbs, Help.hta.  If the sum of the day and month is 13 the worm tries to manipulate files with extensions EXE and DLL.  Subsequently it infects files with extensions HTM, VBA, ASP and HTT on disks.  The worm gets e-mail addresses from them and sends a message to them.  Subject of the message is "Help ", its body is empty and as an attachment it contains the infected file Untitled.htm.  Further on the worm sets the file Help.htm, containing the worm copy, as the desktop wallpaper.  It also manipulates Outlook Express setting in the system registry: it uses its own copy as Stationery (it has a function of a template) for email messages which are in HTML format, and it sets this format as a standard one.
In the system registry the worm creates key HKEY_CURRENT_USER\Software\Help\Count containing a counter.  When the counter reaches value 366, the worm sends a message with infected file Untitled.htm in its attachment.  The used addresses depend on either even or odd number of seconds: if the number of seconds is even the worm sends the message with infected document to addresses found in the received mail folder. If the number of seconds is odd the worm sends a message with subject "Help" to all email addresses found in contacts.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this encyclopedia may be reproduced, transmitted or used in any other way in any other form or by any means without prior permission from Eset.