🚀 go-pugleaf

THIS nasty virus is all over the internet.  Norton caught it for me a
NUMBER of times.

Joe

--
        2001-The year Dick Vermeil comes to KC
               kc_tobyjoe@netzero.net
        "Women are all robots"... Vic Nardozza


Sent via Deja.com
http://www.deja.com/

its been around for over a year
"alexthomson" <alexthomson@ntlworld.com> wrote in message
news:Lcnc6.2502$4C6.90616@news6-win.server.ntlworld.com...
> DO NOT OPEN ANY E MAIL WITH A SHORT STORY ABOUT SNOWWHITE AND THE SEVEN
> DWARFS.
>
> IT IS A VIRUS I FOUND OUT THE HARD WAY ,  AND FORMATTED MY HARD DRIVE
> IMMEDIATELY.
>
> virus recieved on 26/01/01
>
> Alex
>
>

I have InoculateIT which zapped it as soon as I tried to open it.
Don't you think you would be wiser to have an AV program? InoculateIT is
cheap......FREE.
Bob


alexthomson <alexthomson@ntlworld.com> wrote in message
news:Lcnc6.2502$4C6.90616@news6-win.server.ntlworld.com...
> DO NOT OPEN ANY E MAIL WITH A SHORT STORY ABOUT SNOWWHITE AND THE SEVEN
> DWARFS.
>
> IT IS A VIRUS I FOUND OUT THE HARD WAY ,  AND FORMATTED MY HARD DRIVE
> IMMEDIATELY.
>
> virus recieved on 26/01/01
>
> Alex
>
>
>

 Yes, I removed it from a few computers. You need to reinstall the
WSOCK32.dll file after you remove the virus. I can't believe I forgot
the name of the virus HYBIS.GEN  or something similar.

 It was causing some software to act up, but didn't wipe anything out.

 

On Fri, 26 Jan 2001 22:53:20 -0000, "alexthomson"
<alexthomson@ntlworld.com> wrote:

>DO NOT OPEN ANY E MAIL WITH A SHORT STORY ABOUT SNOWWHITE AND THE SEVEN
>DWARFS.
>
>IT IS A VIRUS I FOUND OUT THE HARD WAY ,  AND FORMATTED MY HARD DRIVE
>IMMEDIATELY.
>
>virus recieved on 26/01/01
>
>Alex
>

It is the "Win32.Hybris.B worm. At least that's what InoculateIT told me it
was.

Win32.Hybris is an e-mail worm which modifies WSOCK32.DLL to intercept
outgoing messages in a manner similar to Happy99 (which is also known as
SKA).

However, what differentiates Hybris is its ability to update itself and
extend its functionality using "plugins". This means that what began as a
simple e-mail worm can mutate, complete with new methods of spreading and
avoiding detection.

The body of Hybris contains the basic functions required for infecting
systems and propagating through e-mail. When the worm is run, it immediately
attempts to modify WSOCK32.DLL in the Windows System directory. If the file
is in use, it will create a modified copy and modify WININIT.INI so the
infected copy will replace the original the next time Windows is started.
The temporary copy of WSOCK32.DLL is given a random filename consisting of 8
capital letters from A to P, for example "AFFJOPPF".

The modified WSOCK32.DLL intercepts connections made and data sent and
received by the host. It searches the information looking for e-mail
addresses. After some time, and after checking that there is an active
Internet connection, the worm will send its own e-mail message to the
addresses it collects. The message will include a copy of the worm as an
attachment.

The "From" and "Subject" fields, along with the message body and name of the
attachment are almost infinitely variable, as they are derived from one of
the plugins, called "text". The earlier versions of this plugin would set
the subject to:

"Snowhite and the Seven Dwarfs - The REAL story!"

The body would be set to:

"Today, Snowhite was turning 18. The 7 Dwarfs always
where very educated and polite with Snowhite. When they go out work at
mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddlently,
the door open, and the Seven Dwarfs enter..."

The filename was randomly chosen from the following list:

"sexy virgin.scr"
"joke.exe"
"midgets.scr"
"dwarf4you.exe"


Bob


waMZer <waMZer@Agent.com> wrote in message
news:3a762691.34096628@netnews.voicenet.com...
> Yes, I removed it from a few computers. You need to reinstall the
> WSOCK32.dll file after you remove the virus. I can't believe I forgot
> the name of the virus HYBIS.GEN  or something similar.
>
>  It was causing some software to act up, but didn't wipe anything out.
>
>