At least five variations exist of this complex worm that can update itself via the Internet.
Hybris (W32.Hybris) is a complex supervirus whose e-mail delivery system is similar to Happy 99 and whose programming and payload are similar to MTX. Although this worm has been known for some time, reports of Hybris are increasing worldwide. And while the worm currently contains a relatively harmless payload, Hybris has the capability to upgrade itself via the Internet and therefore could become dangerous. At least five distinct variations of Hybris have been reported by anti-virus software companies so far.
How It Works
Hybris arrives via e-mail with the following characteristics:
From: Hahaha hahaha@sexyfun.net
Subject: Snowhite and the seven Dwarfs - The REAL Story!
Attachment: a variable file name ending with .exe or .scr, most commonly dwarf4you.exe
Body text: "Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at mornign (sic), they promissed (sic) a *huge* surprise. Snowhite was anxious. Suddlently (sic), the door open, and the Seven Dwarfs enter..."
A user clicking on the above attachment will load the worm. Hybris scans the system for e-mail addresses to send itself out over the Internet via e-mail. Hybris also inflects WSOCK32.DLL, renaming it and redirecting Windows.INI to point to the new, infected file. Thereafter, Hybris will send itself via reply mail to whomever sends new e-mails to an infected computer. Hybris is also savvy enough to establish its own Internet connections for the purpose of upgrading itself. What is notable about this worm is that is contains up to 32 Internet components, and can execute them as needed. At the moment, the components sent with Hybris are relatively harmless, however, the potential for new and more dangerous upgrades does exist.
Removal Instructions
Infected users should download the latest anti-virus signature files. Afterward, users will still need to restore a copy of WSOCK32.DLL, either from a clean backup or from the original Windows installation disks.
