Silicon Valley - Public Access Link

Hybris Virus Warning

The Hybris Virus (aka Snow White, Hahaha)

Note that the Hybris (also know as Snow White and Hahaha) e-mail virus is running rampant and there have been infections of some of SVPAL's subscribers. SVPAL recommends that users obtain, install, and maintain anti-virus software on their computers to protect themselves from computer viruses.

Vulnerable Systems

This virus only affects users of Microsoft Windows 95, 98, NT, Me, 2000 and XP.

Impact

This virus attaches itself to WSOCK32.DLL and monitors Internet communication looking for valid e-mail addresses.  When valid e-mail addresses are detected the virus e-mails copies of itself to those e-mail addresses.  This virus is also capable of downloading plug-in modules to extend its capability.

What to Look For

The most common form of this virus arrives in e-mail with:
From: Hahaha <hahaha@sexyfun.net>

Subject: Snow White and the Seven Dwarfs - The REAL story!

Attachment: sexy virgin.scr or joke.exe or midgets.scr or dwarf4you.exe

The body of the email may have a short paragraph that begins: "Today, Show White was turning 18..." or the equivalent in English, French, Spanish, or Portuguese. But note: There are versions of Hybris that arrive with completely different headers (From:, Subject:, To:, etc.) and attachment names. 

It is generally a bad idea to open attachments with file extensions of EXE/COM/BAT/LNK/PIF or SCR as these are programs and can unleash viruses on your computer. 

For more information

Check the CERT Coordination Center for more information on the Hybris virus.  Or check SVPAL's virus page for some general virus protection information.
  

[SVPAL Home]  [Subscriber]

Contact Silicon Valley Public Access Link
Last updated: February 23, 2006