Newsgroup: it.arti.ballo.lat-americano
Titolo: HIBRYS in quarantena nel mio PC!!!!

AHIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!!!!
Stasera il Norton ha fatto il suo dovere e alla solita mail vuota con
allegato "GFLFJMGF.EXE", il mio tesoro di antivirus mi ha informata che lì
dentro c'è...... HIBRYYYYYYYYYYYSSSSSSSS!!!!!! Mi ha anche detto di non
poterlo riparare e allora lo ha sbattuto in quarantena...Dopo avere seguito
i consigli di Norton, sbattuto in galera il virus e chiuso il Norton stesso,
ho provveduto a eliminare subito lo stramaledetto allegato. Domandina: ora
se apro Norton, ovviamente mi avvisa che c'è il maledetto H.... in
quarantena e io vorrei.....farla sparire anche da lì la bestiaccia....ma non
capisco come fare....Ah...la bestia mi è arrivata subito dopo una mail di
aiuto nella ricerca di un donatore di midollo osseo per una ragazza, che
sono certa  avrete ricevuto anche voi....    sssssignùr....e mò che faccio
per toglierlo alla mia vista anche dal Norton???? (Maledetto Hibrys...avrà
mica letto il mio resoconto pure lui ed è venuto apposta perchè ha visto che
non lo volevamo a cena????????.....Azz......oltre che perfido pure
permaloso..... :o(((((( ....
-- 
Posted from 
smtp2.libero.it
 [193.70.192.52] 
via Mailgate.ORG Server - 
http://www.Mailgate.ORG

Entrando in Norton,come per i post puoi eliminarlo evidenziandolo e
cliccando sulla X in alto a destra.
Anche a me è arrivato con lo stesso messaggio.
Ciao.
Flavio G.   BS
--D.J. del Ficus di Iabla--
    sezione lago d'Iseo
----------------------------------------------------------------
Lista Locali Latino Americani gestiti dal Newsgroup
 
http://iabla.cjb.net
                         Serate latine
 
www.serate.it
 
http://www.capitalmusic.com/

 AHIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA!!!!
(...)
Non so come fare per eliminarlo; intanto ti mando queste informazioni che ho
trovato sul sito di Norton.
Ricordati di scrivere al mittente della mail per avvisarlo che ha il virus
nel suo pc.
Ciao,
Valerio
--------8<---------------8<----------------8<----------------------
W95.Hybris.gen
Discovered on: September 25, 2000
Last Updated on: December 12, 2000 2:53:52 PM PST
December 7, 2000:
Due to a recent increase in world-wide infections of this worm, SARC is
increasing the threat level of this worm to 4.
W95.Hybris is a worm that spreads by email as an attachment to outgoing
emails. It was discovered in late September of 2000. Although minimum
reports of infection were reported in October 2000, the worm started to
become common in early Nov 2000.
The message may include the text "Snow White and the Seven dwarves" and the
attachment may have one of several different names, including, but not
limited to:
anpo porn(.scr
atchim.exe
branca de neve.scr
dunga.scr
dwarf4you.exe
enano porno.exe
joke.exe
midgets.scr
sexy virgin.scr
Also known as: W32.Hybris.gen, W32.Hybris.22528.dr, W32/Hybris.gen@M,
I-Worm.Hybris
Category: Worm
Virus definitions: September 25, 2000
Threat assessment:
Wild:
Medium  Damage:
Low  Distribution:
High
Wild
Number of infections: 50-999
Number of sites: More than 10
Geographical distribution: Medium
Threat containment: Moderate
Removal: Moderate
Distribution
Name of attachment: Random with EXE or SCR file name extension
Technical description:
When the worm attachment is executed, the WSOCK32.DLL file will be modified.
This will give the worm the ability to attach itself to all outbound email.
The email attachment will have a random name but the filename extension is
either EXE or SCR).
The worm attempts to connect to the newsgroup alt.comp.virus. After it
connects successfully, the worm uploads its own plug-ins in an encrypted
form to this newsgroup. It goes thru the subject header of the messages, and
tries to match a specific format. The subject header will also specify the
version number of the attached plug-in if these plug-ins are indeed present.
If a newer version of plug-ins is found, the worm downloads these modules
and updates its behavior. For example, there are known modules that give the
worm ability to infect compressed files like ZIP.
If WSOCK32.DLL is being used by the system, the worm will be unable to
modify this file. Thus, in this situation, the worm will add a registry key
to one of the following subtrees:
HKEY_LOCAL_MACHINE\Software\Microsoft\
Windows\CurrentVersion\RunOnce
HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\RunOnce
It will always alternate between these two trees mentioned above as the worm
spreads from one machine to another. The worm hooks on the following exports
on WSOCK32.DLL: send(), recv(), connect(). Whenever a user sends out an
email to a person, the worm will also send out another email to the same
person attaching a copy of itself using a randomly generated filename.
Removal:
Use Norton AntiVirus to repair the infected WSOCK32.DLL. Other files
detected as W95.Hybris contain only the virus body and must be deleted.
Write-up by: Cary Ng and Peter Ferrie
  Tell a Friend about this Write-Up