The Hybris Worm

How It Works

The Hybris worm (also known as "Snow White") spreads by latching on to infected e-mail as an attachment. When the receiver of an infected e-mail message double-clicks on the attachment, Hybris then infects the receiver's computer. From then on the worm sends itself, via reply mail, to everyone who sends or receives new e-mail to and from the infected computer.

What Not To Do

Do NOT open the attachment (in other words, do not double-click on the attached file). Also, see below ("How to prevent the Hybris Worm") for further prevention tips.

What An Infected E-mail Message Looks Like

The Hybris worm arrives via e-mail with variable texts, depending on the particular version (and components) of the virus. The following characteristics are the most common:

From: Hahaha hahaha@sexyfun.net

Subject: Snowhite and the seven Dwarf - The REAL Story!

Body text: "Today, Snowhite was turning 18. The 7 Dwarfs always where very educated and polite with Snowhite. When they go out work at mornign, they promissed a *huge* surprise. Snowhite was anxious. Suddently, the door open, and the Seven Dwarfs enter..."

How To Avoid The Hybris Worm

1. Do NOT open attachments! One of the best ways to prevent virus infections is not to open attachments. Even if an e-mail message is from a known source, be careful. Because a user whose computer is infected with Hybris may not be aware of the infection, even e-mail from your friends may be infected. Always scan the attached files for viruses with a virus-protection program before opening the attachments. Unless an attachment is a file or an image you are expecting, delete the attachment.

2. If you receive the worm as an attachment, notify the sender of the message (see "Notify the Sender of the E-mail Message That Was Infected," below.)

3. Get protected. If you do not already have an anti-virus program on your computer, you should get one.

4. Scan your system regularly with an anti-virus program.

5. Update your anti-virus software.

How To Remove The Worm

1. If you are already using the McAfee anti-virus software, you can find removal instructions at http://vil.mcafee.com/dispVirus.asp?virus_k=9887&

2. If you are already using the Norton anti-virus program, you can find removal instructions at http://service1.symantec.com/sarc/sarc.nsf/html/W95.Hybris.gen.html

3. If you are using any other anti-virus program, go to the manufacturer's Website for removal instructions.

Notify the Sender of the E-mail Message That Was Infected

If you have received an e-mail with the Hybris attachment, you should contact the person who sent you the infected e-mail. Because he probably does not know that his computer is infected, you will want to notify him that a message from him contained the worm.

If you don't notify the sender, his computer will continue to send the worm to all the e-mail addresses on his computer, including your address.