Newsgroup: it.comp.os.win.win9x
Titolo: Informazioni su un Virus!

Ho beccato il seguente virus:
w95.hybris.gen.dr che ha infettato le cartelle C:\...RESTORE, e' stato
neutralizzato con un antivirus.
Di cosa si tratta?

 ha scritto nel messaggio
news:7Zj16.125193$IP1.4...@news1.giganews.com...



Vai su 
http://www.sarc.com
 e inserisci il nome hybris per sapere tutte
le informazioni a riguardo. Comunque (vado a memoria) è abbastanza
rognoso, aggiunge una vxd che parte all'avvio e una volta cancellato
rompe ancora (!). O mi sto sbagliando con Navidad (il virus :)?
Un Ippatsu win32.Ippatsu.worm

 ha scritto nel messaggio...

Dal sito 
www.nai.com
Virus Name  Risk Assessment
W32/Hybris.gen@M  Medium
Virus Characteristics
This is an Internet worm which can be received by email. Typically these
messages will make reference to, "Snowhite and the Seven Dwarfs". If run,
this worm modifies the WSOCK32.DLL file, after which, an attempt is made to
mail a copy of the worm to all mail recipients whenever email messages are
sent out.
AVERT cautions all users to delete unexpected attachments. W32/Hybris.gen@M
is sent unknowingly by the user.
This Internet worm downloads encrypted update components from an Internet
web site, most likely it is the author's site. This worm downloads encrypted
components similar to the method first used by W95/Babylonia.
Symptoms
Mail recipients claiming they received an attachment from you when one was
never sent
Method Of Infection
When this Internet worm is launched, it downloads a file named INDEX.TXT
from the hosting site. This file contains a list of additional files that
the worm is to also download for use. On November 13 2000, the site was
still operational and contained the following update component files:
HTTP.DAT
NEWS.DAT
ENCR.DAT
PR0N.DAT
SPIRALE.DAT
SUB7.DAT
DOSEXE.DAT
AVINET.DAT
As of November 20, 2000, the site hosting the virus was taken down, however,
the virus continues to download plugins from alt.comp.virus.
As of November 21, 2000, a new plugin is being distributed that will enable
W32/Hybris to infect PE files in a non-repairable way. The 4108 DAT set is
required to detect these infected files.
Executing the worm writes a modified version of the WSOCK32.DLL file to the
WINDOWS SYSTEM directory. This file goes by an extensionless filename made
up of 8 random characters. A line is created in the WININIT.INI file to
rename this, newly created, file to WSOCK32.DLL, thus overwriting the
original WSOCK32.DLL file. This change takes place the next time the system
is booted. The modified WSOCK32.DLL file attempts to mail a copy of the
worm, in the form of a .EXE or .SCR file, to all mail recipients whenever
email messages are sent out.
This Internet worm posts update details to a newsgroup named alt.comp.virus.
The message posts is a communication message to the running Internet worm on
hosts to perform self-updates.
The format of the newsgroup posted message is as follows:
anon.lcs.mit.edu
!
nym.alias.net
!mail2news
Message-ID: 
2000111308052...@nym.alias.net
From:
Author-Address: anonymous anon lcs mit edu
Subject: http [44 character alpha code]
Mail-To-News-Contact: 
postm...@nym.alias.net
Organization: 
mail...@nym.alias.net
Newsgroups: alt.comp.virus
Lines: 46
KUWJGJWCVICGIWIWCZIWHCFXCHB [continues]....
[more coded lines]
[terminated by four asterisks]
****
Removal Instructions
Use specified engine and DAT files for detection and removal.
The WSOCK32.DLL file must be restored from backup. This can be done by:
Windows 98
- Click the START MENU|RUN, type SFC and click OK.
- Choose Extract one file from the installation disk
- Type C:\WINDOWS\SYSTEM\WSOCK32.DLL in the box and click Start.
- In the Restore from box type C:\WINDOWS\OPTIONS\CABS or browse to the
Win98 directory on your Windows98 CD-ROM
- Click OK and follow remaining prompts
Windows95
- Click the START MENU|SHUT DOWN choose RESTART IN MS-DOS MODE
- Type: EXTRACT /A C:\WINDOWS\OPTIONS\CABS\WIN95_11.CAB WSOCK32.DLL /L
C:\WINDOWS\SYSTEM
or
- Insert your Windows95 CD-ROM and type:
EXTRACT /A D:\WIN95\WIN95_11.CAB WSOCK32.DLL /L C:\WINDOWS\SYSTEM Where D:
is your CD-ROM drive
Variants
no known variants
Aliases Name
Hybris
I-Worm.Hybris
Snowhite and the Seven Dwarfs
TROJ_HYBRIS.A
W32/Hybris.gen.dll@M
W32/Hybris.gen@M
W32/Hybris.plugin@M
Hasta la vista.
        ZaPp-er
--
ICQ#: 30314157
PGP Key ID: 0xA6F89545
[
ZaP...@libero.it
]
WebPage: 
http://web.tiscalinet.it/emiliano
--

 > Di cosa si tratta?
anche io l'ho ricevuto 3 volte. andate sul sito della symantec, nel motore
di ricerca mettete il nome del virus, e dovrebbe darvi una scheda
dettagliata sul virus
auguri e bune feste
--
Ciao
Marchese Gianfranco
e-mail 
dgr...@tin.it
sito: 
www.gian1.cjb.net
Ci sono un sacco di cose, per computer e consolle,
cheats, guide, soluzioni, consigli, e molte utility
per il replay togliere NOSPAZZATURA