W95.Hybris(aka Snow White)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: W95.Hybris

Sender:

may include but is not limited to:
HaHa

Subject:

may include but is not limited to:
hahaha@sexyfun.net
Snow White and the Seven dwarves

Message:

may include but is not limited to:
hahaha@sexyfun.net
Snow White and the Seven dwarves

Attachment:

anpo porn(.scr
atchim.exe
branca de neve.scr
dunga.scr
dwarf4you.exe
enano porno.exe
joke.exe
midgets.scr
sexy virgin.scr

Comments: a worm that sends itself to all the addresses it finds in the .txt, .eml,.html, .htm, .dbx, and .wab files.

Symptoms:


 Attempts to connect to the alt.comp.virus newsgroup. If it connects
successfully, then the worm uploads its own plug-ins which will
generate a large black and white spiral image.

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Run LiveUpdate to ensure that you have the most recent virus definitions. They must be dated September 25, 2000, or later.
Start NAV, and perform a full system scan. Make sure that NAV is set to scan all files. When an infected file is detected, do the following:
When Wsock32.dll is detected as infected, choose Repair. In most cases, NAV can repair this file. If NAV cannot repair the file, then you will need to replace it from the Windows installation CD.
NOTE: If NAV cannot repair Wsock32.dll when Windows is in normal mode, then try to repair it in Safe Mode. This is particularly true if you are connected to a network; in this case you may see a "sharing violation" message when NAV attempts the repair. To try this, restart the computer in Safe Mode. If this is not successful, then you must extract a new copy as explained in the next section.
Delete all other detected files; their contents have been overwritten by the worm. You must restore them from backups or, in the case of application software, reinstall the programs.If you see a rotating spiral on the Windows desktop, you must follow these additional steps to remove it.
Make sure Windows is set to show all files.
Remove the reference to the plug-in from the Run line of the Win.ini file.
Find and delete the plug-in itself.