Name: W32/Hybris.gen@MM

Characteristics:
This worm will be received in an email message which may contain the
following information:


From: Hahaha [hahaha@sexyfun.net]
Subject: Snowhite and the Seven Dwarfs - The REAL story!
Body: Today, Snowhite was turning 18. The 7 Dwarfs
always where very educated and polite with Snowhite.
When they go out work at mornign, they promissed a
*huge* surprise. Snowhite was anxious. Suddlently, the
door open, and the Seven Dwarfs enter...
Attachment: sexy virgin.scr or joke.exe or midgets.scr
or dwarf4you.exe


When first executed, this worm tries to infect the WSOCK32.DLL file in the
WINDOWS\SYSTEM directory. First it tries to infect the WSOCK32.DLL file
directly. If it fails because the file is already in use, then it creates
an infected copy on the WSOCK32.DLL in a new file. This new file goes by
an extensionless filename made up of 8 random characters. A line is then
created in the WININIT.INI file to rename this newly created file to
WSOCK32.DLL, thus overwriting the original WSOCK32.DLL file. This change
takes place the next time the system is booted. A registry value under
Software\Microsoft\Windows\CurrentVersion\RunOnce\(default) is also
created to run the worm at the next bootup, in case the previous attempts
to infect WSOCK32.DLL fail.
The modified WSOCK32.DLL file watches all Internet activity and attempts
to mail a copy of the worm, in the form of a .EXE or .SCR file, to any
valid e-mail address sent over the Internet connection, whether part of a
e-mail message, web page, or newsgroup posting. AVERT cautions all users
to delete unexpected attachments. W32/Hybris.gen@M is sent unknowingly by
the infected user.
This Internet worm originally downloaded encrypted update components from
an Internet web site, similar to the method first used by W95/Babylonia,
but the site hosting the virus was taken down. The original plugins were:
HTTP.DAT
NEWS.DAT
ENCR.DAT
PR0N.DAT
SPIRALE.DAT
SUB7.DAT
DOSEXE.DAT
AVINET.DAT
Currently this virus downloads plugins from alt.comp.virus. The
virus contains an internal list of several news servers it can access. It
searches the newsgroup for any plugins that it doesn't have, or has older
versions of. Since the worm searches all Internet activity for e-mail
addresses, people who post to alt.comp.virus using their real e-mail
address may get many copies of the worm when Hybris searches
alt.comp.virus for new plugins.
When a full moon occurs according to the computer's internal clock, the
virus will randomly post its plugins to the alt.comp.virus newsgroup. It
uses a mail-to-news gateway at anon.lcs.mit.edu to send plugins with a
fake return address of root@microsoft.com.
This Internet worm contains the text: 
HYBRIS
(c) Vecna


To check your system for this Virus, and to learn how to protect yourself
from computer viruses, visit the McAfee.com Clinic at
http://clinic.mcafee.com/clinic/ibuy/campaign.asp?cid=2103.

For complete information on this Virus, view McAfee.com's Virus
Information Library listing at
http://vil.mcafee.com/dispVirus.asp?virus_k=98873.

F Y I
PASS THIS ON TO ANYONE FOR WHOM YOU HAVE AN E-MAIL ADDRESS.....
If you receive an email titled "Let's watch TV",DO NOT OPEN IT. It will 
erase everything on your hard drive. This information was Announced, 
yesterday morning from IBM; AOL states that "KALI" is a very dangerous 
virus, much worse than "Melissa," and that there is NO remedy for it at 
this time.Some very sick Individual has succeeded in using the reformat 
function from Norton Utilities causing it to completely erase all 
documents on the hard drive. It has been designed to work with Netscape
Navigator and Microsoft Internet Explorer.  It destroys Macintosh and IBM
compatible computers.This is a new, very Malicious virus and not many 
people know about it.... Pass this warning along to EVERYONE in your
address book and Please share it with all your online friends ASAP,,so
that this threat may be stopped. Forward this warning to everyone that 
might access the Internet.

• Advertencia a no abrir el supuesto correo con el virus. Estas son frases como "DON'T OPEN IT" o "bórrelo inmediatamente". En teoría, es posible insertar código ejecutable directamente en el texto del correo electrónico mediante etiquetas HTML. En la práctica, es difícil que un programa maligno se ejecute directamente de un correo electrónico. Por lo general, el virus, gusano o troyano en cuestión viene en forma de attachment o archivo insertado. Usted puede abrir con seguridad cualquier correo electrónico, sin importar de quién venga o qué contenga, a menos que use Outlook u Outlook Express para leer su correo, herramientas fácilmente manipulables por virus.
• Efectos devastadores y sin antivirus. Los virus falsos son "asombrosamente" similares en lo que se refiere a funcionamiento: los que he leído destruyen los sectores de arranque del disco duro o formatean la unidad. Para hacer el cuento más dramático y fatalista, estos "virus" se esparcen por la Red a una velocidad ridícula; y no sólo eso: no existe un antivirus capaz de hacerles frente.
• Mala ortografía. Si la alerta en cuestión tiene mala ortografía, muy seguramente es falsa. Revise el texto en busca de aberraciones como mayúsculas que no estén en nombres propios ni al principio de la oración (del tipo "este Virus..."); puntos suspensivos que no sean tres; proliferación anormal de signos de exclamación; y por supuesto faltas de ortografía. Si ve que el autor de la alarma escribió "Macafee", borre ese correo y dígale al que se lo mandó que deje de enviarle esas tonterías.
• Petición de enviar al mayor número de personas posible. Algunos creadores de páginas relativas al tema han establecido una comparación curiosa: las cartas en cadena, en todas sus formas, y también evidentemente falsas, exigen enviar copias a un número determinado de personas. Esta comparación es lo que les hace incluir a las falsas alarmas de virus como una variante de las cartas en cadena.
• "Referencias" con reputación. Este factor tiene bastante éxito en la propagación de las falsas alarmas de virus. Cuando una persona crédula y/o ignorante sobre virus lee un supuesto reporte donde dice que fue identificado por McAfee, Microsoft o IBM; o cita notas de CNN, se dispara la idea: "Si ellos lo dicen, debe ser cierto". Correcto, la credibilidad de estas fuentes está lejos de ser cuestionable, pero ¿no han pensado si realmente lo dijeron?