Q-C Online support pages
Technical support article

About the Hybris or Snow White virus



A type of computer virus has been spreading around the net over the past couple of months called the Hybris Virus. This virus comes in an E-mail normally from hahaha@sexyfun.net and with a subject of something such as "Snow White and the Seven Dwarfs"



When run, the worm infects WSOCK32.DLL. Whenever an email is sent, the worm attempts to send a copy of itself as an attachment to a separate message to the same recipient. Any other behaviour exhibited by the worm, including the text of the message, is entirely dependent on the set of installed components. Consequently the message can have any subject, any message text and any filename for the attached file, but the ones found being sent to and from QCO are most commonly the Snow White joke.

Opening the attachment launches the worm. If the WSOCK32.DLL, is being used by windows then it creates a copy of the same and infects it. It gives a random eight character file name to the new file which does not have any extension. The worm then overwrites the WININIT.INI to continue its infection routine on next Windows Startup. The registry modifications are done at the following location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

The worm sends mail with any of the above randomly chosen body text and attachments for every outbound mail. Plugins are automatically updated from a website. These plugins are also converted into newsgroup messages and posted. The worm tries to connect automatically to several news servers to post messages to the newsgroup alt.comp.virus.

There is also another component to this virus. On the 24th of September of any year, or at 1 minute to the hour at any day in the year 2001, displays a large animated spiral in the middle of the screen which is difficult to close.

To remove the virus, consult your anti-virus software manual about updating virus definitions and then have it scan your machine. If you are unsure how to do this, contact the provider of your anti-virus software.

For more information on virus updates and anti-virus software, visit our Virus Information section.


Local events heading








  Today is Thursday, July 31, the 212th day of 2014. There are 153 days left in the year.

1864 -- 150 years ago: A corps of surgeons now occupies the new hospital quarters at the Garrison Hospital on the Rock Island Arsenal. A fence has been installed to enclose the prison hospital.
1889 -- 125 years ago: B. Winter has let a contract to Christ Schreiner for a two story brick building with a double store front on the south side of 3rd Avenue just west of 17th Street. The estimated cost was $4,500.
1914 -- 100 years ago: Germany sent simultaneous ultimatums to Russia and France, demanding that Russia suspend mobilization within 12 hours and demanding that France inform Germany within 18 hours. In the case of war between Germany and Russia, France would remain neutral.
1939 -- 75 years ago: Civil service offices at the post office and the Rock Island Arsenal were swamped as more than 700 youths sought 15 machinist apprenticeships at the Arsenal.
1964 -- 50 years ago: Last night, American Legion Post 246 in Moline figuratively handed over the trousers to a female ex-Marine and petticoat rule began. Olga Swanson, of Moline, was installed as the first woman commander of the post .
1989 -- 25 years ago: The Illinois Quad City Civic Center captured the excitement and interest of a convention of auditorium managers this weekend in Reno, Nev. Bill Adams, civic center authority chairman, said the 10,000-seat arena planned for downtown Moline has caught the eye of construction firms, suppliers, management teams and concession groups.








(More History)