VBS/haptime.a

VBS.Haptime.A@mm is a viral Visual Basic Script
contained in an .htm, .vbs, .asp, or .htt file.
It utilizes the stationery feature of Outlook
Express. Stationery is used as an HTML-formatted
new message template, which permits you to change
the background and fonts used in the message. The
worm attempts to replicate by setting HTML as the
default message format and setting an infected
HTML page as the default stationery for Outlook
Express. This is similar to the Wscript.KakWorm
action, when any outgoing message sent from an
infected computer will include the viral script
in it's HTML-formatted body. This worm can infect
your computer if it is displayed in the preview
pane of Outlook Express. This can happen when
switching between folders without having to open
an attachment. This can be prevented by applying
Microsoft's security update patch.

When executed, the script performs the following
actions:

1. It drops itself as Help.hta, Help.vbs,
Help.htm, or Untitled.htm file.
2. It adds the registry key

HKEY_CURRENT_USER\Software\Help\Count

and updates a value with a count of the number of
infected files.

3. The script then looks for .htm, .vbs, .asp,
and .htt files in all folders on both local and
mapped drives. If the sum of the current day and
the current month is 13, then the script tries to
delete all .exe and .dll files.

4. For each file that it finds, VBS.Haptime.A@mm
looks for a "mailto:<email address>" string
inside of the file, retrieves the email address,
and sends the following message to that address:

Subject: Help
Message: (The body of the message is empty.)
Attachment: Untitled.htm (This is infected with
VBS.Haptime.A@mm.)

5. Next, if the file that provided the worm with
the email address is an .htm, .vbs, .asp, or .htt
file, it becomes infected with the viral script.
The name of this file is stored in the registry
key

HKEY_CURRENT_USER\Software\Help\FileName

6. On every 366th infection, the script performs
one of the following two actions with equal
probability:
It looks for messages stored in the Inbox, and
replies to all of them with the following message:

Subject: Fw: <The original sender's email address>
Message: (The body of the message is empty.)
Attachment: Untitled.htm (This is infected with
VBS.Haptime.A@mm.)

It sends out the following message to all email
addresses found in the default Contacts folder:

Subject: Help
Message: (The body of the message is empty.)
Attachment: Untitled.htm (This is infected with
VBS.Haptime.A@mm.)

7. The script sets a new default desktop
wallpaper to display an infected Help.htm page to
enable itself to run at startup. To hide itself,
the infected Active Desktop wallpaper page tries
to use the same desktop background picture as it
was before the infection.

8. The script infects the .htt files in the
<Windows>\Web folder. The HyperText Template
files are used to help you design the content and
the look of your folders. If you have enabled
Windows to view folders as Web pages, the viral
script is executed every time that a folder is
viewed.

9. The worm sets HTML as the default Message
Format. It then sets the infected
<Windows>\Untitled.htm file as the default
Stationery for Microsoft Outlook Express. Any
message sent from Outlook Express will contain
the worm embedded into it's HTML-formatted body.
To provide this kind of replication, the worm
creates the values

Message Send HTML 1
Compose Use Stationery 1
Stationery Name Windows\Untitled.htm

in the registry key

HKEY_CURRENT_USER\Identities\<Default User ID>Software\Microsoft\Outlook Express\5.0\Mail

NOTE: If your email program or the email server
that handles the message is not set up for or
capable of handling HTML encoded messages, the
program or server will convert the encoded
message to an attachment. If you open the
attachment, it can have the same effect as if you
received the email message with the worm embedded.


Removal instructions:

SARC has developed a tool to remove the changes
that were made to a computer by the
VBS.Haptime.A@mm and VBS.Haptime.B@mm worms. To
obtain the VBS.Haptime Fix tool, go to:

http://www.symantec.com/avcenter/venc/data/vbs.hap
time.fix.html

Manual removal
To remove this worm manually, delete .htt files,
and any files detected as VBS.Haptime.A@mm,
delete the registry keys that it added, and reset
your Outlook Express settings. Here are the steps:

To remove the worm:

1. Run LiveUpdate to make sure that you have the
most recent virus definitions.
2. Start Norton AntiVirus (NAV), and run a full
system scan, making sure that NAV is set to scan
all files.
3. Delete any files detected as VBS.Haptime.A@mm.

To delete .htt files:
1. Using windows Explorer, browse to C:\Windows
Web

NOTE: IF you have Windows installed to a
different location, make the appropriate
substitution.

2. Click Start, point ti Find, and then click
Search or Files or Folders.
3. Make sure that "Look in" is set to C:\Windows
Web.
4. In the "Named" or "Search for..." box, type--
or copy and paste--the following file names:

*.htt

5. Click Find Now or Search Now.
6. Delete the files that are found.


To edit the registry:

CAUTION: We strongly recommend that you back up
the system registry before making any changes.
Incorrect changes to the registry could result in
permanent data loss or corrupted files. Please
make sure you modify only the keys specified.
Please see the document How to back up the
Windows registry before proceeding. This document
is available from the Symantec Fax-on-Demand
system. In the U.S. and Canada, call (541) 984-
2490, select option 2, and then request document
927002.
1. Click Start, and click Run. The Run dialog box
appears.
2. Type regedit and click OK. The Registry Editor
opens.
3. Navigate to and delete the following keys:

HKEY_CURRENT_USER\Software\Help\Count
HKEY_CURRENT_USER\Software\Help\FileName

4. Exit the Registry Editor

To reset Microsoft Outlook Express:
1. Start Outlook Express.
2. Click Tools, and click Options.
3. Click the Compose tab.
4. In the Stationery section, if you do not use
stationery when sending email, uncheck Mail.
Otherwise, click Select and select the stationery
that you want to use.