Description: Worm/Ngvck is an Internet worm that spreads through e-mail by using addresses it collects in the Microsoft Outlook Address Book. The worm arrives through e-mail in the following format: Subject: Important: Windows update Body: Hey, at work we are applying this update because it makes Windows over 50% faster and more secure. I thought I should forward it as you may like it. Attachment: MS02-010.exe If executed, the worm copies itself in the root directory under the filename "MS02-010.exe". Additionally, the file "SHARP.VBS" gets added. The file SHARP.VBS is created temporary, it automatically deletes itself after another execution. No autostart - entries are created. It will display a message box with the following text, "You're infected with Win32.HLLP.Sharp, written in C#, by Gigabyte/Metaphase" The original filename received, "MS02-010.exe". Again, I warn you, don't open attachments. This one is going to look pretty legitimate because it will come from someone who has your email address in their Address Book, might even be a relative. Be careful. No one on the list has reported getting it yet. If you get one from someone on this list, let me know off list, please. -- Pat Connors, Sacramento CA, listowner http://www.connorsgenealogy.com All outgoing mail virus free, scanned by Norton 2002