VBS.Haptime.A@mm

As of October 24, 2003, due to a decreased rate of submissions, Symantec Security Response has downgraded the threat level of this worm from Category 3 to Category 2 as of October 24, 2003.

The VBS.Haptime.A@mm worm:

• Is a Visual Basic Script (VBS) worm.
• Infects the .htm, .html, .vbs, .asp, and .htt files.
• Replicates using MAPI objects to spread itself as an attachment.
• Attaches itself to all the outgoing messages using the stationery feature of Outlook Express.

The worm uses a known Microsoft Outlook Express security hole so that the worm is executed without having to run any attachments.
Microsoft has patched this security hole that eliminates security vulnerabilities in "Scriptlet.TypLib" ActiveX controls. The patch is available at:

http://www.microsoft.com/technet/security/bulletin/ms99-032.mspx

If you have a patched version of Outlook Express, this worm will not automatically work.

Definitions dated before May 4, 2001, detect the worm as VBS.Help.A@mm.

Protection

• Initial Rapid Release version April 30, 2001
• Latest Rapid Release version August 20, 2008 revision 017
• Initial Daily Certified version April 30, 2001
• Latest Daily Certified version August 20, 2008 revision 016
• Initial Weekly Certified release date April 30, 2001

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: More than 1000
• Number of Sites: More than 10
• Geographical Distribution: High
• Threat Containment: Easy
• Removal: Moderate

Damage

• Damage Level: Low

Distribution

• Distribution Level: High