PACHESTE-L Archives

Archiver > PACHESTE > 2000-12 > 0978266657


From: (Dave and Karen Quay)
Subject: Re: [PACHESTE] Re: PACHESTE That snow white virus
Date: Sun, 31 Dec 2000 07:44:17 -0500
References: <200012302100.eBUL0o811097@lists5.rootsweb.com> <3A4E6543.1D1F1095@home.com>


Thought I would send this to you to describe the virus.
----- Original Message -----
From: "BRUCE SANDLIER" <>
To: <>
Sent: Saturday, December 30, 2000 5:44 PM
Subject: [PACHESTE] Re: PACHESTE That snow white virus


> wrote:
> > Subject: [PACHESTE] That snow white virus
> > Date: Fri, 29 Dec 2000 21:19:47 -0500
> > From: "Michelle Ross" <>
> > To:
> >
> > Hi everyone,
> >
> > I just wanted to tell you that I just had 4 messages in my in box, the
first one was from an address and the second
one was from hahaha which was the snow white virus BUT I DID NOT OPEN THE
ATTACHMENT. The third message was also from the ctzzy person and the fourth
message was the snow white thing again from hahaha. Now is that a
coincidence or is this ctzzy person sending it along with their messages? I
deleted all 4 immediately and then ran my Mcafee virus scanner and all was
fine. Do you think this person is sending it? Or am I paranoid? I just
lost my whole computer hard drive and had to purchase a new one because I
had no operating system, and I can't afford to do that again.
> >
> > Thanks for hearing me out.
> >
> > Michelle
> According to NAI:
> "This is an Internet worm which can be received by email. Typically
> these messages will make reference to, "Snowhite and the Seven
> Dwarfs". If run, this worm modifies the WSOCK32.DLL file, after
> which, an attempt is made to mail a copy of the worm to all mail
> recipients whenever email messages are sent out.
>
> AVERT cautions all users to delete unexpected attachments.
> W32/Hybris.gen@M is sent unknowingly by the user.
>
> This Internet worm downloads encrypted update components from an
> Internet web site, most likely it is the author's site. This worm
> downloads encrypted components similar to the method first used by
> W95/Babylonia. "
>
> Anyone interested in checking out a possible virus, please visit:
> http://vil.nai.com/vil/default.asp or
> http://www.symantec.com/avcenter/
> --
> Bruce Sandlier
> mailto:
> http://members.home.net/sandlier/index.htm
>
>
> ==== PACHESTE Mailing List ====
> Stop by our associated website for Chester County Genealogy at
> http://www.rootsweb.com/~pacheste/chester.htm
>
>
>
>

This thread: