Yahoo Groups archive

The Logic Off Topic list

Index last updated: 2026-04-28 23:27 UTC

Message

[Fwd: Re: Warning! Beware of: Snowhite and the Seven Dwarfs - The REALstory!]

2001-01-12 by Zeek Duff

This is not a hoax, it's a real virus.  <sigh>  Some people...

This is confirmed by the website below.  Non-Windows machines, of
course, are immune!

http://www.symantec.com/avcenter/venc/data/w95.hybris.gen.html


     ALL: Do NOT download any email that states 'the real story of
     Snow Whites and the seven dwarfs'

     I got an email from hahaha@.... When I went to
     download it, my virus program detected the infection and I
     deleted the file. I replied to the email address and received
     this response...rather interesting I thought:
     From: Auto Responder
     Subject: Autoresponse to your mail, re: Snowhite and the Seven
     Dwarfs - The REAL story!
     Date: Fri, 12 Jan 2001 09:44:49 -0500
     +-------------------
     | Please read this whole email as it contains information that
     can
     | be used to protect your computer from a Virus that is
     spreading
     | around the internet.
     |
     |NOTA BENE: This message is automatically generated; PLEASE DO
     NOT REPLY.
     | Subsequent email with the same reply-to address should not
     | induce additional responses from this service.
     +---------
     Hello,
     You are receiving this message because a email, which
     contained
     your email address as the return / reply-to address, was sent
     to
     hahaha@.... This is a list of possible reasons why you
     received
     this message.
     1) You sent an email to hahaha@... to request,
     complain or notify
     this user that they are SPAMMING, sending an email with a
     virus,
     sending an email that has content that may not be appropriate
     for
     minors, to be removed from a mailing list, etc..
     2) Someone else sent an email to hahaha@... and they
     are using
     your email address as their return / reply-to address. If this
     is
     the case we are sorry that this email was sent to you but
     please
     do read it as it does contain information about a virus that
     is
     spreading around the internet that we are trying to stop /
     slow
     down.
     3) You may already be infected with the computer virus for
     which this
     email is trying to inform you of. This virus (W32.Hybris.gen)
     will send a copy of itself to the reply-to address of any
     incoming
     emails that a infected computer receives. So when you received

     another copy of the "SPAM" that this virus sends out from
     another
     infected computer, the virus sends a copy of itself to
     hahaha@... since hahaha@... is the reply-to
     address
     of the "SPAM" the virus sends out.
     The truth about this SPAM, that contains Snowwhite in the
     Subject, is
     that a virus called W32.Hybris.gen sends out these emails with
     attachments
     that are also infected with this virus from a already infected
     computer
     hopping to infect more computers. This virus uses the address
     book as well
     as scans incoming and outgoing mail and http traffic for email
     address
     to send a copy of itself to. These emails the virus sends out
     use a
     fake / spoofed FROM: address of hahaha@... to hide its
     tracks.
     We registered the domain sexyfun.net in order to provide the
     people
     of the internet information about this virus as well as tips
     on how
     to detect, clean, trace and protect yourself from this virus.
     Here is a list of other facts that may answer some of your
     questions
     that you may have already.
     1) We do NOT maintain any mailing lists on our system.
     2) This user (hahaha) does NOT exist on our system.
     3) The email that you got with the From: field of
     hahaha@...
     did NOT come from sexyfun.net or the hosting companies
     network.
     This email address was FAKED / SPOOFED.
     4) The email you got is in FACT a way for the (W95.Hybris.gen)
     virus
     to spread itself around the world / Internet like the ILOVEYOU

     virus of a few months past.
     5) If you would look at the Received: line of the FULL email
     header, it
     will tell you the real IP / Computer name that has sent you
     this
     virus, which is most likely someone you know that is infected
     with
     the virus and is not aware of it.
     6) The owner of the domain sexyfun.net and the hosting company
     has
     setup a help page with information about the (W95.Hybris.gen)
     virus, links to software that you can use to clean your
     computer
     if you are infected as well as other misc. information.
     7) We did NOT create the virus or know who the person is that
     created
     the virus. We are NOT affiliated with this person / persons
     and the
     same applies to our hosting company.
     NOTE: As long as you don't run / open / double click on the
     attachment
     of this email, this virus should not be able to infect you
     just
     by reading the email.
     Here are links to well known companies of anti-virus products
     that
     will show that what has been said above is true.
     http://www.f-secure.com/v-descs/hybris.shtml
     http://www.kaspersky.com/news.asp?tnews=0&nview=1&id=134&page=0

     This is the link to the website we have setup to provide
     additional
     information about this Virus.
     http://www.sexyfun.net/ (this is not a adult site of any type)

     If have any questions about this, our contact information is
     located on
     our web site ( http://www.sexyfun.net/ )
     Thanks you for your time.
     -----
     NOTE: Any replies sent to this email are not viewed by us.
     Please use
     our contact information located on our site. Thanks.

     --------------------------------------------------------------

     Get your FREE download of MSN Explorer at
     http://explorer.msn.com

Attachments

Move to quarantaine

This moves the raw source file on disk only. The archive index is not changed automatically, so you still need to run a manual refresh afterward.