What is the Haptime.A Worm?

The Haptime.A worm:

• Is a Visual Basic Script (VBS) worm.
• Infects the .htm, .html, .vbs, .asp, and .htt files.
• Replicates using MAPI objects to spread itself as an attachment.
• Attaches itself to all the outgoing messages using the stationery feature of Outlook Express.

The worm uses a known Microsoft Outlook Express security hole so that the worm is executed without having to run any attachments. Microsoft has patched this security hole that eliminates security vulnerabilities in "Scriptlet.TypLib" ActiveX controls. The patch is available at:

http://www.microsoft.com/technet/security/bulletin/ms99-032.mspx

If you have a patched version of Outlook Express, this worm will not automatically work.

Also known as: VBS.Help.A@mm, I-Worm.HappyTime, VBS.HappyTime, VBS_HAPTIME.A, VBS.Happytime.A, VBS/Haptime@MM, VBS/Haptime-Fam

How to Remove the Haptime.A Worm?

Kaspersky Internet Security Can Prevent You From Virus and Intrusion. If Kaspersky detects Haptime.A during the scan, it will AUTOMATICALLY offer you the option of deleting it. Do this by following the program's instructions.

To manually remove this worm, delete the .htt files, and any files detected as Haptime.A, delete the registry keys that it added, and reset your Outlook Express settings. Follow these steps:

To remove the worm

Run a full system scan and delete all the files detected as Haptime.A.

1. Start your Kaspersky Internet Security and make sure that it is configured to scan all the files.
2. Run a full system scan.
3. If any files are detected as infected with Haptime.A, click Delete.

To delete .htt files

1. Using Windows Explorer, browse to C:\Windows Web.
   
   NOTE: If you have Windows installed to a different location, make the appropriate substitution.
     
2. Click Start, point to Find, and then click Search or Files or Folders.
3. Make sure that "Look in" is set to C:\Windows Web.
4. In the "Named" or "Search for..." box, type, or copy and paste, the following file name:
    
   *.htt
    
5. Click Find Now or Search Now.
6. Delete the files that are found.

To edit the registry

CAUTION: We strongly recommend that you back up the system registry before making any changes. Incorrect changes to the registry could result in permanent data loss or corrupted files. Make sure that you modify the specified keys only.

1. Click Start, and then click Run. The Run dialog box appears.
2. Type regedit, and click OK. The Registry Editor opens.
3. Navigate to and delete the following keys:
   
   HKEY_CURRENT_USER\Software\Help\Count
   HKEY_CURRENT_USER\Software\Help\FileName

    4. Exit the Registry Editor.

To reset Microsoft Outlook Express

1. Start Outlook Express.
2. Click Tools, and then click Options.
3. Click the Compose tab.
4. In the Stationery section, if you do not use stationery when sending email, uncheck Mail. Otherwise, click Select and select the stationery that you want to use.

How to Disinfect My Computer from Worms?

In order to keep your computer protected, bear the following tips in mind:

1. If you have filtering tools installed, configure them to reject messages with the characteristics described above. If, in spite of doing this, you receive the message that contains the virus: do not open it, do not run the attached file and delete it, making sure that you also delete it from the Deleted Items folder.
2. Install a good antivirus in your computer. Select Kaspersky Internet Security to get the Kaspersky antivirus solution that best suits your needs.
3. Keep your antivirus updated. If automatic updates are available, configure your antivirus to use them.
4. Keep your permanent antivirus protection enabled at all times.

Detect and Removal Instruction for Other Worms - 'H':