[Dshield] virus

Scott Johnson scott at advancedtool.com
Tue Aug 14 12:59:17 GMT 2001


The "Snowwhite" hybris worm is an email based worm that uses your mailing 
list to spread.  It's largely identified by the return address as "hahaha" 
and contains a short story about Snow White and the dwarves involved in 
activities that might make a sailor blush with shame.

In any event, the attachment is the worm.  This worm has been around the 
internet and back several times.  If anyone has this worm they should make 
sure they're protected by a good virus scanner.. (or one period) and 
relatively up to date signature files.  Now, lets face it.. snowwhite has 
been out there for a long time.  Anyone infected in this manner is REALLY 
out dated and probably not taking care of their system's virus scanning 
needs.  This being said, I get a copy of this fool thing at least once or 
twice a week.  I'm sure somebody out there is willing to see what Snow 
White is doing with the dwarves...  I myself?  they're short and there's 
seven of them...  Umm..  Snow White honey?  you can do better!  If not.. at 
least get more money!

--Scott

At 08:54 PM 08/13/2001 -0700, you wrote:
>At: http://vil.mcafee.com I searched for "Snowhite" and got one hit. I
>searched for "Hybris" and got several hits. If I searched for both together
>I got no hits.
>
>
>----- Original Message -----
>From: "billconn" <blconn at theramp.net>
>To: <dshield at dshield.org>
>Sent: Thursday, July 19, 2001 4:05 PM
>Subject: [Dshield] virus
>
>
> > While getting email-error was mail transferring. SMTP server said: 553
> > Snowhite-Hybris worm. See http://vil.mcafee.c.
> >
> > After calling our server, they said to try this site, but do not see
> > anything pertaining to above. Said there was a program that could be
> > downloaded??  Appreciate any help you can give
> >
> > _______________________________________________
> > Dshield mailing list
> > Dshield at dshield.org
> > To change your subscription options (or unsubscribe), see:
>http://www1.dshield.org/mailman/listinfo/dshield
> >
>
>_______________________________________________
>Dshield mailing list
>Dshield at dshield.org
>To change your subscription options (or unsubscribe), see: 
>http://www1.dshield.org/mailman/listinfo/dshield




More information about the list mailing list