Q-C Online support pages
Technical support article

About the Hybris or Snow White virus



A type of computer virus has been spreading around the net over the past couple of months called the Hybris Virus. This virus comes in an E-mail normally from hahaha@sexyfun.net and with a subject of something such as "Snow White and the Seven Dwarfs"



When run, the worm infects WSOCK32.DLL. Whenever an email is sent, the worm attempts to send a copy of itself as an attachment to a separate message to the same recipient. Any other behaviour exhibited by the worm, including the text of the message, is entirely dependent on the set of installed components. Consequently the message can have any subject, any message text and any filename for the attached file, but the ones found being sent to and from QCO are most commonly the Snow White joke.

Opening the attachment launches the worm. If the WSOCK32.DLL, is being used by windows then it creates a copy of the same and infects it. It gives a random eight character file name to the new file which does not have any extension. The worm then overwrites the WININIT.INI to continue its infection routine on next Windows Startup. The registry modifications are done at the following location: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce

The worm sends mail with any of the above randomly chosen body text and attachments for every outbound mail. Plugins are automatically updated from a website. These plugins are also converted into newsgroup messages and posted. The worm tries to connect automatically to several news servers to post messages to the newsgroup alt.comp.virus.

There is also another component to this virus. On the 24th of September of any year, or at 1 minute to the hour at any day in the year 2001, displays a large animated spiral in the middle of the screen which is difficult to close.

To remove the virus, consult your anti-virus software manual about updating virus definitions and then have it scan your machine. If you are unsure how to do this, contact the provider of your anti-virus software.

For more information on virus updates and anti-virus software, visit our Virus Information section.


Local events heading








  Today is Wednesday, April 23, the 113th day of 2014. There are 252 days left in the year.

1864 — 150 years ago: Some persons are negotiating for 80 feet of ground on Illinois Street with a view of erecting four stores thereon. It would serve a better purpose if the money was invested in neat tenement houses.
1889 — 125 years ago: The Central station, car house and stables of the Moline-Rock Island Horse Railway line of the Holmes syndicate, together with 15 cars and 42 head of horses, were destroyed by fire. The loss was at $15,000.
1914 — 100 years ago: Vera Cruz, Mexico, after a day and night of resistance to American forces, gradually ceased opposition. The American forces took complete control of the city.
1939 — 75 years ago: Dr. R. Bruce Collins was reelected for a second term as president of the Lower Rock Island County Tuberculosis Association.
1964 — 50 years ago: Work is scheduled to begin this summer on construction of a new men's residence complex and an addition to the dining facilities at Westerlin Hall at Augustana College.
1989 — 25 years ago: Special Olympics competitors were triple winners at Rock Island High School Saturday. The participants vanquished the rain that fell during the competition, and some won their events; but most important, they triumphed over their own disabilities.




(More History)