Virus Characteristics:
This Visual Basic Script virus will append itself to files, delete files, and can spread via embedded VBScript, contained in the body of HTML formatted email messages.
When the script is permitted to run, the virus inserts itself at the end of .ASP, .HTM, .HTML, .HTT, and .VBS files. If the current day plus the current month is equal to 13, the virus attempts to delete .DLL and .EXE files on local and network drives.
The virus saves its viral code to HELP.HTA and HELP.VBS in the first directory found on the C: drive, and to HELP.HTM and UNTITLED.HTM in the WINDOWS directory.
Method Of Infection:
VBS/Haptime exists as embedded VBScript code, hidden in the body of HTML formatted email messages and webpages. When an infected document is opened and the script is allowed to execute, the local machine is infected. Once infected, the local machine begins transmitting the virus via email, and LAN propagation.