Details:
Name: Worm/Ngvck
Alias: <none>
Type: Internet Worm
Discovered: 2502-2002
Size: ~12KB
ITW: No
Description:
Worm/Ngvck is an Internet worm that spreads through email by
using addresses it collects in the Microsoft Outlook Address Book.
The worm arrives through email in the following format:
Subject: Important: Windows update
Body: Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I should forward it as you may like it. Attachment: MS02010.exe
If executed, the worm copies itself in the root directory directory under the filename "MS02010.exe". Additionally, the file "SHARP.VBS" gets added. The file SHARP.VBS is temporary
created, it automatically deletes itself after another execution. No autostart entries are created.
It will display a message box with the following text, "You're infected with Win32.HLLP.Sharp, written in C#, by Gigabyte/Metaphase"
The original filename received, "MS02010.exe".
Trend Micro does not have this warning up yet, but here is the place to read about current worms and viruses and to find out more about the new worm when they update the site:
http://www.antivirus.com/vinfo/Norton does not have more info on the worm, but this is where you will find it when they update their web site: http://sarc.com/
McAfee doesn't have info on this worm either. It was just discovered.