Ron, am I right in my thinking that it's the attached file that is the home of
the worm? It's not embedded in the text body of the message some way is it?

It came across my computer and I deleted immediately. But sure left me feeling
insecure!

John Rodgers
88 GL Driver

Ron Lussier wrote:

> >Currently I am downloading Norton Anti Virus on this lap
> >top and am hoping I can rescue my main computer drive
> >using rescue disks from NAV.  Anyone know how to do this
> >fix?   Please help!
> >
> >I'm bummin but I am hopeful.  Any help appreciated.
> >Darn its going to be a long night.
>
> Whoops.  According to CERT.org:
>
> Although other versions of W32/Hybris have been identified by the
> anti-virus community, reports to the CERT/CC indicate that the worm
> is spreading via email with the following characteristics:
>
> From: Hahaha <hahaha@sexyfun.net>
> Subject: Snowhite and the Seven Dwarfs - The REAL story!
> Attachment: .SCR or .EXE file (name randomly chosen from a predefined list)
>
> This worm infects the WSOCK32.DLL file. On an infected machine,
> whenever a user sends out an email to a person, the worm will send
> out another email to the same person with a copy of itself as an
> attachment.
>
> ---
>
> Perhaps if you copy your WSOCK32.DLL file from a good machine to your
> infected one?  (This should be in your windows/SYSTEM32 directory, if
> I remember correctly.  As a Mac user, I'm not affected ha ha ha.)
>
> Coyote
> --
>                          /\_/\      ____
> Ron 'Coyote' Lussier   (     )     \ _/__                   Lenscraft
> coyote@lenscraft.com    \   /       \X  /       229 8th Street Unit 4
> 1.415.241.0815           \_/          \/      San Francisco, CA 94103