VIRUS Update: Nondestructive

[Richard J Senghas]

Folks,

I'm including in this message info I gleaned from Trend Micro's website
(http://www.antivirus.com) about the virus (actually worm) that went out on
the Linganth list recently.

The basic message is that this is a nondestructive annoyance that clutters
up discs and bandwith. In other words, it is a low-anxiety situation.

-Richard
Linganth Administrator

=====================================

Virus Encyclopedia
TROJ_HYBRIS.A
Aliases:
Snow White, I-Worm.Hybris, W32/Hybris at M,
Win32.Hybris.Gen, TROJ_HYBRIS.A,
TROJ_HYBRIS.D, TROJ_HYBRIS.B,
TROJ_HYBRIS.C, TROJ_HYBRIS.E,
TROJ_HYBRIS.GEN, TROJ_HYBRIS.DLL, TROJ_HYBRIS.PX
Description:
This semi-polymorphic worm propagates via email and may also spread through
Newsgroup postings. It does not have any destructive payloads. However, it
has several known plug-ins that maybe upgraded to make it malicious. Upon
execution, this worm monitors Internet access from the infected computer,
as well as email sent and received.  Once it detects Internet connection,
it sends an additional email to all addresses that infected user sent email
to after the worm was executed.  This email has a copy of the worm as an
attachment. The filename of the attachment is selected randomly depending
upon the system default language of the infected computer.

Solution: [This is a reference to a particular anitvirus application
available thorugh Trend Micro. -RJS]
1.Use the Emergency Rescue Disk (ERD) to delete all files
detected as TROJ_HYBRIS (all variants).

2.It may happen that WSOCK32.DLL is also deleted in the
process. In that case, please copy a clean WSOCK32.DLL in the Windows
System directory. This WSOCK32.DLL can be extracted from WIN95_11.CAB (Win
95 CD) or PRECOPY1.CAB (Win 98 CD). You may also copy this file from a
clean system with exactly the same Windows version.

======================================================================
Richard J Senghas, Asst. Professor       | Sonoma State University
Department of Anthropology/Linguistics   | 1801 East Cotati Avenue
Coordinator, Linguistics & TESL Programs | Rohnert Park, CA 94928-3609
Richard.Senghas at sonoma.edu               | 707-664-2312 (v); 664-3920 (fax)