1. Symantec/
  2. Security Response/
  3. VBS.Haptime.A@mm


Risk Level 2: Low

April 29, 2001
February 13, 2007 11:36:26 AM
Also Known As:
VBS.Help.A@mm, I-Worm.HappyTime [Kaspersky], VBS.HappyTime [CA, Dialogue Science], VBS_HAPTIME.A [Trend], VBS.Happytime.A [Hauri], VBS/Haptime@MM [McAfee], VBS/Haptime-Fam [Sophos]
Systems Affected:
CVE References:

As of October 24, 2003, due to a decreased rate of submissions, Symantec Security Response has downgraded the threat level of this worm from Category 3 to Category 2 as of October 24, 2003.

The VBS.Haptime.A@mm worm:
  • Is a Visual Basic Script (VBS) worm.
  • Infects the .htm, .html, .vbs, .asp, and .htt files.
  • Replicates using MAPI objects to spread itself as an attachment.
  • Attaches itself to all the outgoing messages using the stationery feature of Outlook Express.

The worm uses a known Microsoft Outlook Express security hole so that the worm is executed without having to run any attachments.
Microsoft has patched this security hole that eliminates security vulnerabilities in "Scriptlet.TypLib" ActiveX controls. The patch is available at:


If you have a patched version of Outlook Express, this worm will not automatically work.

Definitions dated before May 4, 2001, detect the worm as VBS.Help.A@mm.

Antivirus Protection Dates

  • Initial Rapid Release version April 30, 2001
  • Latest Rapid Release version August 8, 2016 revision 023
  • Initial Daily Certified version April 30, 2001
  • Latest Daily Certified version August 9, 2016 revision 001
  • Initial Weekly Certified release date April 30, 2001
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
Writeup By: Serghei Sevcenco

Search Threats

Search by name
Example: W32.Beagle.AG@mm
STAR Antimalware Protection Technologies
2016 Internet Security Threat Report, Volume 21
  • Twitter
  • Facebook
  • LinkedIn
  • Google+
  • YouTube