🚀 go-pugleaf

It is the "Win32.Hybris.B worm. At least that's what InoculateIT told me it
was.

Win32.Hybris is an e-mail worm which modifies WSOCK32.DLL to intercept
outgoing messages in a manner similar to Happy99 (which is also known as
SKA).

However, what differentiates Hybris is its ability to update itself and
extend its functionality using "plugins". This means that what began as a
simple e-mail worm can mutate, complete with new methods of spreading and
avoiding detection.

The body of Hybris contains the basic functions required for infecting
systems and propagating through e-mail. When the worm is run, it immediately
attempts to modify WSOCK32.DLL in the Windows System directory. If the file
is in use, it will create a modified copy and modify WININIT.INI so the
infected copy will replace the original the next time Windows is started.
The temporary copy of WSOCK32.DLL is given a random filename consisting of 8
capital letters from A to P, for example "AFFJOPPF".

The modified WSOCK32.DLL intercepts connections made and data sent and
received by the host. It searches the information looking for e-mail
addresses. After some time, and after checking that there is an active
Internet connection, the worm will send its own e-mail message to the
addresses it collects. The message will include a copy of the worm as an
attachment.

The "From" and "Subject" fields, along with the message body and name of the
attachment are almost infinitely variable, as they are derived from one of
the plugins, called "text". The earlier versions of this plugin would set
the subject to:

"Snowhite and the Seven Dwarfs - The REAL story!"

The body would be set to:

"Today, Snowhite was turning 18. The 7 Dwarfs always
where very educated and polite with Snowhite. When they go out work at
mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddlently,
the door open, and the Seven Dwarfs enter..."

The filename was randomly chosen from the following list:

"sexy virgin.scr"
"joke.exe"
"midgets.scr"
"dwarf4you.exe"


Bob


waMZer <waMZer@Agent.com> wrote in message
news:3a762691.34096628@netnews.voicenet.com...
> Yes, I removed it from a few computers. You need to reinstall the
> WSOCK32.dll file after you remove the virus. I can't believe I forgot
> the name of the virus HYBIS.GEN  or something similar.
>
>  It was causing some software to act up, but didn't wipe anything out.
>
>