Taken directly from
http://service1.symantec.com/sarc/sarc.nsf/html/W95.Hybris.gen.html
W95.Hybris.gen
Commonly known as: HAHAHA or Snow White virus.
Also Known As: W32.Hybris.gen, W32.Hybris.22528.dr, W32/Hybris.gen@M,
I-Worm.Hybris
Discovered on: September 25, 2000
Due to a recent increase in world-wide infections of this worm, SARC is
increasing the threat level of this worm to 4 and adding it to the "Top
Threats" list.
W95.Hybris is a worm that spreads by email as an attachment to outgoing
emails. This worm infects the WSOCK32.DLL file. On an infected machine,
whenever a user sends out an email to a person, the worm will send out
another email to the same person with a copy of itself as an attachment. It
was discovered in late September of 2000. Although minimum reports of
infection were reported in October 2000, the worm started to become common
in early Nov 2000.
The message may include the text "Snow White and the Seven dwarves" and the
attachment may have one of several different names, including, but not
limited to:
anpo porn(.scr
atchim.exe
branca de neve.scr
dunga.scr
dwarf4you.exe
enano porno.exe
joke.exe
midgets.scr
sexy virgin.scr.
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of RSR FL
> Sent: Friday, January 26, 2001 9:33 AM
> To: [EMAIL PROTECTED]
> Subject: RE: [IMail Forum] Sn0w Wh1te
>
>
> We have been getting hit with same plus d*warf*4u, s*xy v*irgin
> and others.
> It seems to go in spurts. Weeks nothing then wham tons of them.
>
> Mike
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED]]On Behalf Of Chris Hunt
> Sent: Friday, January 26, 2001 9:15 AM
> To: [EMAIL PROTECTED]
> Subject: [IMail Forum] Sn0w Wh1te
>
>
> Any one else getting a rash of the Sn0w Wh1te virus? The rules.ima is
> catching them just fine but I like to track down the sender. Seems like
> this list sent out two yesterday evening. The email header has the ISP
> listed as donet.com but nothing in my IMail logs shows any contact with
> them.
> Chris
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
>
> Please visit http://www.ipswitch.com/support/mailing-lists.html
> to be removed from this list.
>
> An Archive of this list is available at:
> http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
>
Please visit http://www.ipswitch.com/support/mailing-lists.html
to be removed from this list.
An Archive of this list is available at:
http://www.mail-archive.com/imail_forum%40list.ipswitch.com/
