From: Nicole < >
Date: Fri, 04 May 2001 17:35:47 -0700
X-Mailer: Mozilla 4.75 [en] (WinNT; U)

This is what the virus does:

Upon execution, this worm patches the WSOCK32.DLL so that it attaches itself
to emails sent out from the infected computer. Once the worm patches the
WSOCK32.DLL, it monitors Internet activity, including the sending and
receiving of email.

If the worm cannot modify WSOCK32.DLL because it is being used when the worm
file is run, it creates a randomly named file, such as "FIDGFNIK" in the
Windows System directory. This is a patched copy of the WSOCK32.DLL. It then
creates a file WININIT.INI, so that next time Windows starts, "FIDGFNIK"
is renamed to WSOCK32.DLL, thus successfully completing the patching of
WSOCK32.DLL

It probably works only on Windows 9x platforms...

Nicole

"Nyffenegger, Ralph" wrote:

> A recent e-mail sent to the members of the swiss-list from sender "hahaha"
> contains the virus "TROJ_HYBRIS.B". I don't know what the virus does...
>
> Ralph
>
> =================================================================
> To unsubscribe from the swiss-list mailing list send the
> message body of "unsubscribe swiss-list" to majordomo_at_swiss-list.com
> or visit http://www.swiss-list.com

--
--------------------------------------------------------
Nicole Hillbrecht
headwire
25006 crystal circle
lake forest
ca 92630, usa
++1 949 595 4365
http://www.headwire.com
headwire - connect your brain
we make the future come true
--------------------------------------------------------
=================================================================
To unsubscribe from the swiss-list mailing list send the
message body of "unsubscribe swiss-list" to majordomo_at_swiss-list.com
or visit http://www.swiss-list.com