Skip to main content
Gerry | Vanagon
Checking account...
← vanagon.com home · Continue the discussion in the forum
Subject:Re: Snow white nightmare
From:Ron Lussier
Date:Fri, 5 Jan 2001 23:18:11 -0800

>Currently I am downloading Norton Anti Virus on this lap
>top and am hoping I can rescue my main computer drive
>using rescue disks from NAV.  Anyone know how to do this
>fix?   Please help!
>
>I'm bummin but I am hopeful.  Any help appreciated.
>Darn its going to be a long night.

Whoops.  According to CERT.org:

Although other versions of W32/Hybris have been identified by the
anti-virus community, reports to the CERT/CC indicate that the worm
is spreading via email with the following characteristics:

From: Hahaha <hahaha@sexyfun.net>
Subject: Snowhite and the Seven Dwarfs - The REAL story!
Attachment: .SCR or .EXE file (name randomly chosen from a predefined list)

This worm infects the WSOCK32.DLL file. On an infected machine,
whenever a user sends out an email to a person, the worm will send
out another email to the same person with a copy of itself as an
attachment.

---

Perhaps if you copy your WSOCK32.DLL file from a good machine to your
infected one?  (This should be in your windows/SYSTEM32 directory, if
I remember correctly.  As a Mac user, I'm not affected ha ha ha.)

Coyote
--
                         /\_/\      ____
Ron 'Coyote' Lussier   (     )     \ _/__                   Lenscraft
coyote@lenscraft.com    \   /       \X  /       229 8th Street Unit 4
1.415.241.0815           \_/          \/      San Francisco, CA 94103