you might want to notify your well meaning but (DON"T OPEN ATTACHMENTS!) less than (DON"T OPEN ATTACHMENTS!) well informed (DON"T OPEN ATTACHMENTS!) users...




W32.HLLP.Sharpei@mm
Discovered on: February 26, 2002
Last Updated on: February 27, 2002 at 09:57:35 AM PST

W32.HLLP.Sharpei@mm is a virus that targets .exe files under the Microsoft .NET Framework. The replication code of the virus is written in C# and compiled to MSIL. The virus also mass emails itself to all contacts in the Microsoft Outlook address book by using a VBS component. The attachment is MS02-010.exe.

Type: Virus, Worm
Infection Length: 12288
(LiveUpdateTM): February 27, 2002

Threat Assessment:

Wild: Low
Damage: Low
Distribution:
Medium

Payload:
Large scale e-mailing: Yes
Modifies files: Yes
Distribution:

Subject of email: Important: Windows update
Name of attachment: MS02-010.exe
Size of attachment: 12,288

Technical description:


The virus arrives as an email message that has the following characteristics:

Subject : Important: Windows update

Message: Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I should forward it as you may like it.

Attachment: Ms02-010.exe

When the attachment is executed, the virus does the following:

It makes a copy of itself as C:\Ms02-010.exe.

It drops the file Sharp.vbs, which then performs the mass-mailing routine, sending the previously described message. Sharp.vbs then deletes itself.