>Snow White, as fas as I can tell, ISN'T a "read the address book and forward
>yourself" virus. The copies I've examined seem instead to have been
>consciously sent to spam lists -- it's a script-kiddie job, not a
>self-forwarder.
According to some information I found on a virus site, it is:
The modified WSOCK32.DLL file watches all Internet activity and
attempts to mail a copy of the worm, in the form of a .EXE or .SCR file,
to any valid e-mail address sent over the Internet connection, whether
part of a e-mail message, web page, or newsgroup posting. AVERT
cautions all users to delete unexpected attachments.
W32/Hybris.gen@M is sent unknowingly by the infected user.
