Description:
Worm/Ngvck is an Internet worm that spreads through e-mail by using
addresses it collects in the Microsoft Outlook Address Book.
The worm arrives through e-mail in the following format:
Subject: Important: Windows update
Body: Hey, at work we are applying this update because it makes Windows
over 50% faster and more secure. I thought I should forward it as you
may like it.
Attachment: MS02-010.exe
If executed, the worm copies itself in the root directory under the
filename "MS02-010.exe". Additionally, the file "SHARP.VBS" gets
added.
The file SHARP.VBS is created temporary, it automatically deletes itself
after another
execution. No autostart - entries are created. It will display a message
box with the following text, "You're infected with Win32.HLLP.Sharp,
written in C#, by
Gigabyte/Metaphase" The original filename received, "MS02-010.exe".
Again, I warn you, don't open attachments. This one is going to look
pretty legitimate because it will come from someone who has your email
address in their Address Book, might even be a relative. Be careful.
No one on the list has reported getting it yet. If you get one from
someone on this list, let me know off list, please.
--
Pat Connors, Sacramento CA, listowner
http://www.connorsgenealogy.com
All outgoing mail virus free,
scanned by Norton 2002