Virus: Win32.Hybris.B worm

[Guest guest]

Dear Raktambara prabhu.

PAMHO AGTSP

 

I got some info on this virus from the internet at:

 

http://www.sophos.com/virusinfo/analyses/w32hybrisb.html

and

http://syninfo.com/ian/PRIVATE/2000/12/05/2000120519400061.html

 

It can replicate, and has a number of other names too that are listed

towards the end of the info on the second site.

 

It must have slipped onto the cow conference from a com user, as it

replicates by attaching itself to email messages to random places. It could

still get back on com, as it can change its name.

 

If you think it is required please post this to all com users.

 

Heres an excerpt from the sophos site:

W32/Hybris-B is a worm capable of updating its functionality

over the internet.

 

It consists of a base part and a collection of upgradeable

components. The components are stored within the worm

body encrypted with 128-bit strong cryptography.

 

When run, the worm infects WSOCK32.DLL. Whenever an

email is sent, the worm attempts to send a copy of itself as

an attachment to a separate message to the same recipient.

 

Any other behaviour exhibited by the worm is entirely

dependent on the set of installed components. The effects of

components known to Sophos at the time of writing are

described below.

 

The text of the email message is determined by one of the

installed components, and hence can be changed by the

upgrading mechanism detailed below.

 

Consequently the message can have any subject, any

message text and any filename for the attached file.

 

A common component of the worm checks the language

settings of the computer it has infected, and selects a

message accordingly from:

 

English

 

Subject:

Snowhite and the Seven Dwarfs - The REAL story!

 

Message text:

polite with Snowhite. When they go out work at mornign,

they promissed a *huge* surprise. Snowhite was anxious.

Suddlently, the door open, and the Seven Dwarfs enter...

 

Your servant

Samba das