Re: OT-spam

[pshute@xxxxxxxxxxxxx]

On Mon, 22 Jan 2001 16:59:46 -0800, Alan Zinn <azinn@xxxxxxxxxx>
wrote:

>This is the heading:
>
>Return-Path: MAILER-DAEMON
>Date: Mon, 22 Jan 2001 09:43:41 -0800 (PST)
>From: Hahaha <hahaha@xxxxxxxxxxx>
>Subject: Snowhite and the Seven Dwarfs - The REAL story!

It's a virus.  I assume it's using its victims' PCs to email out more
copies.  I doubt it's spam coming from a single source.

Here's some parts of virus the description on www.vet.com.au:

>Hybris (Also known as Win32.Hybris)
>Win32.Hybris is an e-mail worm which modifies WSOCK32.DLL to intercept outgoing messages in a manner similar to Happy99 (which is also known as SKA). 
>
>However, what differentiates Hybris is its ability to update itself and extend its functionality using "plugins". This means that what began as a simple e-mail worm can mutate, complete with new methods of spreading and avoiding detection. 
>
>The "From" and "Subject" fields, along with the message body and name of the attachment are almost infinitely variable, as they are derived from one of the plugins, called "text". The earlier versions of this plugin would set the subject to: 
>
>"Snowhite and the Seven Dwarfs - The REAL story!"
>
>The body would be set to: 
>
>"Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddlently, the door open, and the Seven Dwarfs enter..."
>
>The filename was randomly chosen from the following list: 
>
>"sexy virgin.scr"
>"joke.exe"
>"midgets.scr"
>"dwarf4you.exe"

Peter Shute