VBS/Bubbleboy is a NEW type of worm: Unlike previous worms transmitted through email, this new type of worm does not come as an executable attachment. Instead, VBS/Bubbleboy infects PCs as soon as the transmitting email message is opened. This is a VERY significant innovation! In the past, it was not possible to contract a virus or worm merely by opening and reading an email message. This is no longer true, and VBS/Bubbleboy marks the beginning of a more dangerous computing environment.

VBS/Bubbleboy is transmitted through an email message with the subject heading "Bubbleboy is back!" It will ONLY infect PCs running Windows 98 with Internet Explorer 5 and Outlook or Outlook Express. PCs using Outlook are infected upon opening the email message, while Outlook Express users may be infected by viewing the message with Outlook Express's "Preview Pane" feature! When the email is opened, the worm creates a file called UPDATE.HTA. The next time the PC is booted up, the worm sends itself embedded in an email to EVERY address in EVERY MS Outlook address book on the local system. It does this only once.

• Get detailed info on how VBS/Bubbleboy works
• Scan now for instant detection and removal (requires McAfee Clinic subscription. Sign Up for a 14-day FREE trial subscription!)
• Get the EXTRA.DAT file (bubb-4.exe) for McAfee VirusScan 4.0.25 and above to add detection capability for VBS/Bubbleboy
• Download Microsoft's patch for Internet Explorer 5

Notes on detection, removal, and protection:
VirusScan Online (Scan Now and ActiveShield) has been updated to detect VBS/Bubbleboy.
VirusScan 4.0.25 and above require the EXTRA.DAT (bubb-4.exe) in order to detect VBS/Bubbleboy.
Microsoft has issued a patch for Internet Explorer 5 that will prevent the worm from executing under default security settings.
If the worm is detected before it has sent itself to your address book contacts, you should find and delete the file UPDATE.HTA. If the worm has already sent itself to your contacts, you should do nothing; the worm will not do anything further, and your PC is now effectively inoculated against re-infection. To protect your system against infection, disable Windows Scripting Host by following these steps: Click the Start button, Settings, Control Panel, then select Add/Remove Programs, then select the Windows Setup tab, then double-click Accessories, scroll down to Windows Scripting Host, and uncheck the box. Save changes and close the window.

• Purchase McAfee VirusScan 4.03
• Purchase the McAfee VirusScan Upgrade Maintenance Plan, and never get caught with an out-of-date version!