1. /
  2. Security Response/
  3. VBS.Haptime.A@mm

VBS.Haptime.A@mm

Risk Level 2: Low

Discovered:
April 29, 2001
Updated:
February 13, 2007 11:36:26 AM
Also Known As:
VBS.Help.A@mm, I-Worm.HappyTime [Kaspersky], VBS.HappyTime [CA, Dialogue Science], VBS_HAPTIME.A [Trend], VBS.Happytime.A [Hauri], VBS/Haptime@MM [McAfee], VBS/Haptime-Fam [Sophos]
Type:
Worm
Systems Affected:
Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
CVE References:
CVE-1999-0668

As of October 24, 2003, due to a decreased rate of submissions, Symantec Security Response has downgraded the threat level of this worm from Category 3 to Category 2 as of October 24, 2003.

The VBS.Haptime.A@mm worm:
  • Is a Visual Basic Script (VBS) worm.
  • Infects the .htm, .html, .vbs, .asp, and .htt files.
  • Replicates using MAPI objects to spread itself as an attachment.
  • Attaches itself to all the outgoing messages using the stationery feature of Outlook Express.


The worm uses a known Microsoft Outlook Express security hole so that the worm is executed without having to run any attachments.
Microsoft has patched this security hole that eliminates security vulnerabilities in "Scriptlet.TypLib" ActiveX controls. The patch is available at:

http://www.microsoft.com/technet/security/bulletin/ms99-032.mspx

If you have a patched version of Outlook Express, this worm will not automatically work.

Definitions dated before May 4, 2001, detect the worm as VBS.Help.A@mm.

Antivirus Protection Dates

  • Initial Rapid Release version April 30, 2001
  • Latest Rapid Release version February 19, 2013 revision 016
  • Initial Daily Certified version April 30, 2001
  • Latest Daily Certified version February 20, 2011 revision 002
  • Initial Weekly Certified release date April 30, 2001
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

  • Wild Level: Medium
  • Number of Infections: More than 1000
  • Number of Sites: More than 10
  • Geographical Distribution: High
  • Threat Containment: Easy
  • Removal: Moderate

Damage

  • Damage Level: Low

Distribution

  • Distribution Level: High
Writeup By: Serghei Sevcenco

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
Internet Security Threat Report
Symantec DeepSight Screensaver