F-Secure Virus Descriptions : Hard

NAME:	Hard
ALIAS:	HardHead, VBS/Hard.A@MM

Hard is a Visual Basic Script mass mailer (worm) that tries to disguise a virus warning .

VARIANT: Hard.A

Hard.A worm spreads to all resipients listed in Outlook Express address book. It arrives in a message that looks as follows:

        ----- Original Message -----
        From: warning@symantec.com
        To: supervisor@av.net; security@softtools.com;
        mark_fyston@storess.net; directorcut@ufp.com;
        pjeterov@goldenhit.org; kim_di_yung@freeland.ch;
        james.heart@macrosoft.com

        Subject: FW: Symantec Anti-Virus Warning

        Hello,

        There is a new worm on the Net.
        This worm is very fast-spreading and very dangerous!

        Symantec has first noticed it on April 04, 2001.

        The attached file is a description of the worm and how it
        replicates itself.

        With regards,
        F. Jones
        Symantec senior developer

        Attachment: www.symantec.com.vbs

Hard.A contaians a payload that activates on November 24. Then the worm shows a message box with the following title and text:

	Some shocking news

	Don't look surprised!
	It is only a warning about your stupidity
 	Take care!

[Analysis: Katrin Tocheva, F-Secure Corporation; May, 2001]