Date:         Fri, 5 Jan 2001 23:18:11 -0800
Reply-To:     Ron Lussier <rlussier@LENSCRAFT.COM>
Sender:       Vanagon Mailing List <vanagon@gerry.vanagon.com>
From:         Ron Lussier <rlussier@LENSCRAFT.COM>
Subject:      Re: Snow white nightmare
Comments: To: kokopellis@ATT.NET
In-Reply-To:  <20010106065916.JWAO2234.mtiwmhc27.worldnet.att.net@webmail.worldnet.att.n
              et>
Content-Type: text/plain; charset="us-ascii" ; format="flowed"

>Currently I am downloading Norton Anti Virus on this lap
>top and am hoping I can rescue my main computer drive
>using rescue disks from NAV.  Anyone know how to do this
>fix?   Please help!
>
>I'm bummin but I am hopeful.  Any help appreciated.
>Darn its going to be a long night.

Whoops.  According to CERT.org:

Although other versions of W32/Hybris have been identified by the
anti-virus community, reports to the CERT/CC indicate that the worm
is spreading via email with the following characteristics:

From: Hahaha <hahaha@sexyfun.net>
Subject: Snowhite and the Seven Dwarfs - The REAL story!
Attachment: .SCR or .EXE file (name randomly chosen from a predefined list)

This worm infects the WSOCK32.DLL file. On an infected machine,
whenever a user sends out an email to a person, the worm will send
out another email to the same person with a copy of itself as an
attachment.

---

Perhaps if you copy your WSOCK32.DLL file from a good machine to your
infected one?  (This should be in your windows/SYSTEM32 directory, if
I remember correctly.  As a Mac user, I'm not affected ha ha ha.)

Coyote
--
                         /\_/\      ____
Ron 'Coyote' Lussier   (     )     \ _/__                   Lenscraft
coyote@lenscraft.com    \   /       \X  /       229 8th Street Unit 4
1.415.241.0815           \_/          \/      San Francisco, CA 94103