VBS/Helper.Worm<P>Helper is a new virus that also has worm<BR>capabilities, found in the wild in China.<BR>It spreads through the OutLook Express mail<BR>client and also infects files with extensions<BR>.HTM and .HTT on the system.<P>Once activated, the worm creates copies of<BR>itself as HELP.VBS, HELP.HTA, HELP.HTM, and<BR>UNTITLED.HTM under the Windows directory.<BR>It then registers UNTITLED.HTM as Stationary<BR>for Outlook Express by adding the following<BR>registry keys:<P>HKEY_CURRENT_USER\Identities\<default user id>\Software\Microsoft\Outlook<BR> Express\5.0\Mail\, "Message Send HTML"<BR>HKEY_CURRENT_USER\Identities\<default user id>\Software\Microsoft\Outlook<BR> Express\5.0\Mail\, "Compose Use Stationery"<BR>HKEY_CURRENT_USER\Identities\<default user id>\Software\Microsoft\Outlook<BR> Express\5.0\Mail\, "Stationery Name"<P>Any new mail composed after infection will<BR>have the virus embedded as Visual Basic<BR>Script in the message body.<P>HELP.HTM will be registered as wall paper<BR>by adding the following key:<P>HKEY_CURRENT_USER\Control Panel\desktop\wallPaper<P>It will run help.htm if the active desktop<BR>is enabled.<P>As a virus, it appends itself to host<BR>files, increasing their size by 9,900 bytes.