1. /
  2. Security Response/
  3. VBS.Haptime.A@mm


Risk Level 2: Low

April 29, 2001
February 13, 2007 11:36:26 AM
Also Known As:
VBS.Help.A@mm, I-Worm.HappyTime [Kaspersky], VBS.HappyTime [CA, Dialogue Science], VBS_HAPTIME.A [Trend], VBS.Happytime.A [Hauri], VBS/Haptime@MM [McAfee], VBS/Haptime-Fam [Sophos]
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
CVE References:

As of October 24, 2003, due to a decreased rate of submissions, Symantec Security Response has downgraded the threat level of this worm from Category 3 to Category 2 as of October 24, 2003.

The VBS.Haptime.A@mm worm:
  • Is a Visual Basic Script (VBS) worm.
  • Infects the .htm, .html, .vbs, .asp, and .htt files.
  • Replicates using MAPI objects to spread itself as an attachment.
  • Attaches itself to all the outgoing messages using the stationery feature of Outlook Express.

The worm uses a known Microsoft Outlook Express security hole so that the worm is executed without having to run any attachments.
Microsoft has patched this security hole that eliminates security vulnerabilities in "Scriptlet.TypLib" ActiveX controls. The patch is available at:


If you have a patched version of Outlook Express, this worm will not automatically work.

Definitions dated before May 4, 2001, detect the worm as VBS.Help.A@mm.

Antivirus Protection Dates

  • Initial Rapid Release version April 30, 2001
  • Latest Rapid Release version February 19, 2013 revision 016
  • Initial Daily Certified version April 30, 2001
  • Latest Daily Certified version February 20, 2011 revision 002
  • Initial Weekly Certified release date April 30, 2001
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment


  • Wild Level: Medium
  • Number of Infections: More than 1000
  • Number of Sites: More than 10
  • Geographical Distribution: High
  • Threat Containment: Easy
  • Removal: Moderate


  • Damage Level: Low


  • Distribution Level: High
Writeup By: Serghei Sevcenco

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report