Example: [Collected on the Internet, 2002]
From: Hahaha [email@example.com]
Subject: Snowhite and the Seven Dwarfs - The REAL story!
Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddlently, the door open, and the Seven Dwarfs enter...
(This message is accompanied by an attachment with a .SCR or .EXE file extension .)
Origins: Snow White (also known as W95.Hybris.gen) is a worm activated when a victim receives a message like the one quoted above and executes its attachment. The worm modifies (or replaces) the recipient's wsock32.dll file, then replicates by sending the same message (with a forged return address of firstname.lastname@example.org to addresses found in the recipient's
See the links below for more information on how to detect and remove Snow White.
| W95.Hybris.gen |
(Symantec Security Response)
| W32/Hybris.gen@MM |
(McAfee Virus Information Library)