Info for listers,
This in info on how to detect and remove the hybris virus, also known as
"snow white". The web site sexyfun is not a porn site. :-) This virus
is again making its rounds.
Bless you, Bob Lee
--
oozing on the muggy shore of the gulf coast
[email protected]
--- Begin Message ---
+-------------------
| Please read this whole email as it contains information that can
| be used to protect your computer from a Virus that is spreading
| around the internet.
|
|NOTA BENE: This message is automatically generated; PLEASE DO NOT REPLY.
| Subsequent email with the same reply-to address should not
| induce additional responses from this service.
+---------
/....
[Translate, Traduisent, Ubersetzen, Traducono, Traduzem, Traducen]
(Translations were done by kind visitors to our site)
Portuguese: www.sexyfun.net/letters/auto/portuguese.html
Spanish: www.sexyfun.net/letters/auto/spanish.txt
French: www.sexyfun.net/letters/auto/french.html
Finnish: www.sexyfun.net/letters/auto/finnish.txt
..../
+-------------------
| Please read this e-mail in its entirety as it contains information
| that you can use to protect your computer from a Virus spreading
| around the Internet.
|
| NOTE: This message is automatically generated; PLEASE DO NOT REPLY.
| Subsequent e-mail with the same reply-to address should not
| induce additional responses from this service.
+-------------------
Hello,
You are receiving this message because an e-mail, which contained
your e-mail address as the return/reply-to address, was sent to
[email protected]. Possible reasons you received this message are
as follows:
1) You sent an e-mail to [email protected] to complain to or notify
this user about their SPAMMING, sending an e-mail with a virus,
sending an e-mail that has content that may not be appropriate for
minors and/or to remove yourself from a mailing list, etc.
2) Someone else sent an e-mail to [email protected] and they are using
your e-mail address as their return/reply-to address. If this is the
case, we are sorry that this e-mail was sent to you. However, please
read it, as it contains information about the Virus we are trying to
stop from spreading across the Internet.
3) Your anti-virus software sent an e-mail back to [email protected] to
inform them that the e-mail they sent contained a virus. Most
of the time, this e-mail is sent without your knowledge by the
anti-virus software itself.
4) Someone has subscribed the e-mail address [email protected] to a mailing
list to which you are also subscribed. The program that sends this
message out tries to make sure that it is not responding to any e-mails
that it receives from a list server by checking the full e-mail headers
for list information. Some lists do not provide any keys in their full
e-mail headers that we can use to keep the our program from responding.
If you think this is the case, please contact your list admin and have
them remove [email protected] from their member list.
This Spam, containing "Snowhite" in the Subject, is a Virus called
Hybris.gen. It sends out e-mail from your e-mail program with
attachments also infected with the virus, in an attempt to infect more
computers. This virus scans incoming and outgoing mail and http traffic
for e-mail addresses to send a copy of itself to. The e-mail the virus sends
out use a fake or spoofed "FROM:" address of [email protected] to hide its
tracks.
We registered the domain http://www.sexyfun.net to provide you,
the Internet user, with information about this Virus, tips on how to
detect, clean and trace it, and how to protect your computer from it in
the future.
Here are some other facts that may answer questions you may already have:
1) We do NOT maintain any mailing lists on our system.
2) This user (hahaha) does NOT exist on our system.
3) The e-mail you got with the From: field of [email protected] did NOT
come from sexyfun.net or the web hosting companys network. This
e-mail address was FAKED or SPOOFED.
4) The e-mail you got is a way for the Hybris.gen Virus to spread
itself around the Internet just like the ILOVEYOU Virus that surfaced
a year ago.
5) The "Received:" line of the FULL e-mail header will tell you the IP or
Computer name of the person(s) that sent you the Virus. Most likely,
it came from someone you know who is unaware that his or her computer
is infected with the virus.
6) By visiting the domain http://www.sexyfun.net, you will find helpful
information about the Hybris.gen Virus and links to software you
can use to clean your computer if you are infected, as well as other
miscellaneous information.
7) We did NOT create the virus nor do we know the person(s) who created the
virus. We are NOT affiliated with this person or persons. The same
applies to our web hosting company.
NOTE: As long as you don't run/open/double click on the attachment
of the e-mail, this virus should not be able to infect you just by
reading the e-mail.
Here are links to well known companies of anti-virus products that
will show that what has been said above is true:
http://www.zdnet.com/enterprise/stories/main/0,10228,2716778,00.html
http://www.f-secure.com/v-descs/hybris.shtml
http://vil.mcafee.com/dispVirus.asp?virus_k=98873&;
http://www.kaspersky.com/news.asp?tnews=0&nview=1&id=134&page=0
This is the link to the website we have set up to provide additional
information about the Virus:
http://www.sexyfun.net/ (this is not an adult site of any type)
If have any questions about this, our contact information is located on
our web site (http://www.sexyfun.net/)
Thank you for your time.
-----
NOTE: Any replies sent to the e-mail address of our auto-responder are not
viewed by us. Please use the contact information located on our web
site.
Thank you.
--- End Message ---
